Add loader and child plugin for VBK files #1012
Conversation
|
Thanks for this contribution, we never got around to this anymore internally 😄 |
dissect/target/filesystems/vbk.py
Outdated
|
|
||
| @staticmethod | ||
| def _detect(fh: BinaryIO) -> bool: | ||
| raise TypeError("Detect is not allowed on VBKFilesystem class") |
There was a problem hiding this comment.
Why not? The loader may do the heavy lifting most of the time, but denying this ability is needlessly limiting.
There was a problem hiding this comment.
Good point, I have now changed this. I couldn't identify a magic header in the VBK, so for now it will try to initialize the complete VBK object to see if it is valid which might be not the best way from a performance perspective. If you have a better suggestion for it would be happy to implement.
| is_vmx = self.path.name.lower().endswith(".vmx") | ||
| is_disk = re.match(r'.{8}-.{4}-.{4}-.{4}-.{12}', self.path.name) | ||
|
|
||
| if is_vmx: |
There was a problem hiding this comment.
@Schamper I tried to implement this the way you proposed with the find_all. It works for plain disks within the VBK (altough I am not sure if this works correctly when there are multiple disks of the same machine in the VBK). But how to handle the VMX files? I would like not to re-write the logic the VmxLoader already implements again, but just calling the VmxLoader().map() does not seem to work. You got any pointers for me?
This PR adds support for handling VBK files. Currently we have to extract them using
vbk-extractfromdissect.archive, but by adding a loader for them we no longer have to go through this. This also gives the benefit is being able to extract/target specific hosts within the VBK.For now I have only added support for child items which are vmx files, or direct backups of hosts (which in my case ended up in a disk with a certain identifier in the VBK). I coudn't figure a nice way to find the correct child items via a configuration file or something. If anyone thinks of a better way to identify the childs within a VBK I would be happy to implement!