Dissect — The Cyber Toolchain

Dissect 3.22

Thu, 26 Feb 2026 16:12:00 GMT

Dissect 3.22 adds certlog and AD plugins, APFS/AD1 filesystem support, target-inspect tool, and keychain-based FortiGate decryption • Adds the `certlog` plugin for parsing Active Directory Certificate Services with specific tables: `certlog.requests`, `certlog.request_attributes`, `certlog.crls`, `certlog.certificates`, and `certlog.certificate_extensions`. • Adds the Windows AD `-f ad` plugin to parse NTDS.dit databases, exposing sub-tables: `ad.users`, `ad.computers`, `ad.group_policies`, and `ad.secretsdump` for credential extraction. • Adds support for APFS filesystems (macOS) via the new dissect.apfs module. • Adds support for AD1 encrypted filesystems. • Introduces the NTDS filesystem to allow treating the Active Directory database as a mountable filesystem. • Adds `target-inspect`, a debugging tool for inspecting different layers of the dissect target hierarchy. • Enhances `walkfs` plugin with filetype and mimetype detection capabilities. • Adds keychain support for decrypting FortiGate firmware files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.21

Tue, 25 Nov 2025 15:18:02 GMT

Dissect 3.21 adds dissect.database API, APFS filesystem support, new CLI flags for nested targets and syslog parsing • Adds `dissect.database` project to supersede `dissect.esedb` and `dissect.sql` (API only) • Adds initial macOS filesystem support via the new `dissect.apfs` API • Adds `--list-children`, `--recursive`, and `--child` flags to `target-query` for nested target exploration • Adds `-f search` flag to use the new Windows Search Index plugin • Adds `-f network.interfaces --syslog` to parse syslog entries in addition to network interfaces • Adds CramFS filesystem support • Adds Apple Sparse Image Format (ASIF) support • Adds KAPE files in VHD format support • Adds `>` output redirection inside `target-shell` Breaking changes: • The minimum Python version is now 3.10, removing support for older versions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.20.1

Wed, 10 Sep 2025 08:25:51 GMT

Dissect 3.20.1 adds Linx DHCP parsing, voidtools DB support, YARA string matches, and btrfs sub-volume mounting. • Adds the Linx network plugin with DHCP lease file parsing functionality • Adds new plugin for voidtools Everything DB files • Adds a new plugin for recentlyused.xbel files from Linux desktops • Enables mounting btrfs sub-volumes with target-mount enabled Breaking changes: • Dissect 3.21 will drop Python 3.9 support, requiring Python >= 3.10 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.19

Mon, 26 May 2025 09:33:21 GMT

Dissect 3.19 adds direct single-file targeting via `--direct`, NFS acquisition, QNXFS support, and new plugin families • Allows `target-query` to process a single file directly as a target using the new `--direct` flag • Enables NFS network acquisition in `acquire` with the `--enable-nfs` flag alongside `--children` • Adds `reload` function to `target-shell` for re-scanning disk changes without restarting the session • Introduces `cstruct-stubgen` tool in dissect.cstruct to generate Python stub files (`*.pyi`) for cstruct definitions • Supports Cellebrite UFDX and UFD loaders for forensic image ingestion • Adds Docker container image support as a new loader/container type • Provides first-release QNXFS module and filesystem support via `dissect.qnxfs` v1.0 • Adds VBK file loader for VirtualBox checkpoint backup files • Supports Oracle VirtualBox child disk images • Implements Apache VirtualHost parsing capability • Expands `acquire` to handle Colima container runtime acquisition on macOS • Adds `vmtar` tool in dissect.hypervisor to unpack Visor tar files • Makes chunk size configurable in dissect.archive • Adds Amcache Pca function via `-f amcache.general,amcache.applaunches` • Supports Rustdesk logs via `-f rustdesk.logs` • Supports Anydesk logs and file transfer data via `-f anydesk.logs,anydesk.filetransfer` • Supports capability history via `-f cam.history` • Supports Windows MSN chat history via `-f msn.history` • Supports Windows RDP bitmap cache paths and recovery via `-f rdpcache.paths,rdpcache.recover` • Supports MFT body file parsing via `-f mft.body` • Supports Rapid7 Velociraptor artifact ingestion via `-f velociraptor.results,acquire.hashes,acquire.handles` • Adds `--children` argument to the `target-info` tool Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.18

Mon, 10 Mar 2025 14:07:23 GMT

Dissect 3.18 adds `target-diff`, `target-qfind`, MSSQL error log support, and a new plugin directory structure. • Adds the `target-diff` tool to compare two targets • Adds the `target-qfind` tool to search for artifacts across targets • Adds a capability access manager (CAM) plugin accessible via `-f os.windows.regf.cam` • Adds Acquire MSSQL error log support • Adds Office add-ins plugin support • Adds preliminary NFS support for acquisition • Introduces a new plugin directory structure allowing plugins to be organized in subdirectories accessed via dotted paths like `-f path.to.plugin_dir.plugin_name` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.17.1

Tue, 10 Dec 2024 10:26:37 GMT

Dissect 3.17.1 adds Linux network parsing plugin and GNOME trash support • Adds the initial version of the new Linux network plugin for parsing `NetworkManager` and `Systemd-networkd` configuration files • Adds support for mounted GNOME trash folders Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.17

Mon, 18 Nov 2024 15:54:59 GMT

Dissect 3.17 adds dissect.fve for LUKS/BitLocker volumes, BSD Vinum support, and target-shell -c / rc file options • Adds `dissect.fve` new project to access encrypted LUKS and Microsoft Bitlocker volumes • Supports BSD Vinum volumes in `dissect.volume` via the new container • Adds new MacOS network interface plugin for macOS disk images • Adds new Windows network interface plugin for Windows disk images • Registry plugin now searches paths used by legacy Windows versions for registry files • Adds Ubuntu snap application package manager plugin • Adds new Windows installed applications plugin • Adds new Windows MSSQL log plugin • Enables setting aliases at runtime in `target-shell` • Adds `-c` option to `target-shell` to execute commands directly without interactive shell • Adds `--as-json` option to `target-query` to output plugins and loaders in JSON format • Adds birthtime, blocksize and number of blocks to filesystem stat output • Configuration parser can now access binary configurations • Configuration parser can now parse .env files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.16.1

Mon, 16 Sep 2024 14:19:03 GMT

Dissect 3.16.1 adds libvirt/qemu/unnotepad jump-list plugins, target-yara, target-fs -l/-h and Android backup support. • New `target-yara` command as a standalone entry point, separating YARA scanning from `target-query` • New `-l` and `-h` flags added to `target-fs ls` for detailed and human-readable listing output • New `--root` flag in the `etc` plugin to specify an alternate starting directory • New `libvirt` child plugin to dissect virtual machines hosted by libvirt • New `qemu` child plugin to dissect QEMU-based virtual machine images • New plugin to extract unsaved Notepad tabs from memory or disk artifacts • New plugin to extract Windows Jump List information for forensic analysis of recent file access • New plugin to extract Windows Update Agent (WUA) registration and history data • New MFT segmentation ability within the NTFS parser • Support for Android backups added via new loader capability • VirtualBox .vdi loader now handles case-insensitive format attributes more robustly • 90% speedup in the `walkfs` plugin for faster filesystem traversal Breaking changes: • The hard dependencies on `lz4` and `lzo` extras of `dissect.util` are removed; these are now separate optional extras of the `dissect` package (`pip install dissect[lz4,lzo]`) and are not installed by default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.16

Tue, 10 Sep 2024 12:52:54 GMT

Dissect 3.16 adds libvirt/qemu child plugins, unsaved Notepad and Jump List extractors, target-fs ls flags, and shell history. • Adds `dissect.plugins.libvirt` and `dissect.plugins.qemu` child plugins to parse virtual machine artifacts from Hyper-V/libvirt/QEMU disk images. • Adds a new plugin to extract unsaved tabs from Notepad++ files for recovering recently opened but never saved content. • Adds a new plugin to extract Windows Jump List information, including recently accessed files and frequent applications, from `.dat` files. • Adds `-l` (long format) and `-h` (human-readable) options to the `dissect.target target-fs ls` command for improved output readability. • Adds shell history persistence to `target-shell`, allowing users to recall previously executed commands within the interactive session. • Extends VirtualBox `.vdi` loader to accept case-insensitive file extensions (e.g., `.VDI`, `.Vdi`). • Improves LVM loader to gracefully handle and skip missing physical disks instead of failing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.15

Mon, 01 Jul 2024 09:33:26 GMT

Dissect 3.15 adds MPLog parsing to Windows Defender plugin and supports glob patterns in target config queries • `dissect.target` config query plugin now supports glob patterns in searches. • Windows Defender plugin gains `MPLog` parser support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.14

Wed, 08 May 2024 12:56:27 GMT

New dissect.archive module with WIM support; target-dump namespace plugins; multi-target acquisition and NTFS MFT range parsing • Introduces `dissect.archive` module with parsers for various archive and backup formats including WIM (excluding split files) • Allows targeting multiple sources in a single `acquire` invocation • Adds `AnyDesk` paths to the standard acquisition configuration • Enables yielding MFT segments within specified ranges via `dissect.ntfs` • Extends the root filesystem with a new layer filesystem in `dissect.target` • Adds TOML parsing support to the Unix Config Parser in `dissect.target` • Adds Fortinet FW file support in `dissect.target` Breaking changes: • `rdtype` field renamed from `type` in TCP Splunk adapter records (flow.record) • New internal record fields `rd__source`, `rd__classification`, and `rd_generated` added to flow.record Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.13

Fri, 08 Mar 2024 08:58:15 GMT

Dissect 3.13 adds vmtar and cpio filesystem support, Brave/IIS/Docker/log plugins, JSON/YAML/XML config, TPM ESXi state • Adds `vmtar` (archive based filesystem) support • Adds `cpio` (archive based filesystem) support • Adds the Brave browser plugin as `apps.browser.brave` • Adds the Docker logs plugin as `apps.container.docker.logs` • Adds the Linux locate plugin as `os.unix.locate` • Browser plugins now support reporting cookie data for Firefox and Chromium-based browsers • IIS plugin finds logs in default directories when configuration files are absent • Unified configuration parser supports JSON, YAML and XML formats • Support TPM encrypted ESXi "local state" filesystem Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.12

Fri, 26 Jan 2024 13:45:08 GMT

Dissect 3.12 adds FortiOS platform support, JFFS filesystem mounting, and PuTTY/Citrix/SchedLgU plugins • Adds `FortiOS` platform support as a Linux sub-OS • Adds PuTTY plugin in the `apps/ssh` section • Adds Citrix Netscaler webserver logs plugin in the `apps/webservers` section • Adds SchedLgU plugin to parse SchedLgU.txt logs in the `os/windows/log` section • Adds fuse3 support to `target-mount` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.11

Mon, 18 Dec 2023 12:54:26 GMT

Dissect 3.11 adds btrfs and jffs filesystem support, improves target-query hash output, and changes walkfs behavior. • Adds initial support for `jffs` filesystem (not yet available in dissect.target) • `walkfs` now walks the target's root filesystem instead of all separate filesystems • Previously unmounted but detected filesystems are mounted under `$fs$/fs` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.10

Wed, 08 Nov 2023 14:50:02 GMT

Dissect 3.10 adds OVA and LUKS v2 volume support, `target-query` dry-run/exclude flags, and a unified config parser. • `target-shell` on Unix gains a new `registry` subcommand that reads system configuration files using the `etc` plugin. • `target-query` adds the `--dry-run` flag to preview which functions specified by `-f` would execute without actually running them. • `target-query` adds the `-xf` flag to exclude specific functions when wildcards are used with `-f`. • New volume loader supports LUKS v2 encrypted volumes for forensic analysis. • New volume loader supports DDF (Disk Data Format) RAID volumes used by Dell systems. • New loader supports Open Virtual Appliance (.ova) disk images as target sources. • Adds an `etc` plugin that implements a unified configuration parser supporting .ini, key-value, shell script, systemd, and sshd-style config files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.9

Tue, 26 Sep 2023 15:19:41 GMT

Dissect 3.9 adds SMB loader support, Windows DPAPI decryption, and volatile directory mounting for local targets • Adds `smb` loader to mount an SMB share as a target volume • Enables decrypting and using System DPAPI secrets on Windows • Mounts volatile directories automatically when running on a local target • Adds plugins for cPanel lastlogin files, Symantec Secure Endpoint, Windows 10 notifications from appdb.dat, Linux volatile artifacts (sockets, processes), and Linux modules/lsmod Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.8.1

Mon, 14 Aug 2023 14:58:19 GMT

Adds OSPlugin support for Citrix Netscalers in Dissect 3.8.1 • Add a OSPlugin for citrix netscalers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.8

Thu, 10 Aug 2023 12:52:01 GMT

Dissect 3.8 adds OpenVPN, OSX user/IP plugins, MultiRawLoader, and target-shell enter/save improvements • Adds `OpenVPN` configuration plugin for client and server configurations • Adds `User` plugin to show all users on OSX targets • Adds `IPs` plugin to extract IPs from OSX targets • Adds MultiRawLoader support for loading multiple disks via a + separated path string (e.g., `/path/to/disk1+/path/to/disk2`) • Enables opening nested targets in target-shell using the `enter ` command • Adds globbing support for Windows registry queries via Registry improvements Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.7

Thu, 06 Jul 2023 09:29:01 GMT

Dissect 3.7 adds plugins for Windows tasks (AD GPO), AppX debug keys, Sophos logs, Linux systemd journal, and IIS log loading • The `tasks` plugin now emits Windows jobs created by `at.exe`. • The `tasks` plugin now emits tasks derived from Active Directory Group Policy Objects. • A new `appxdebugkeys` plugin provides AppX debug information. • The Windows Defender plugin can now emit exclusion entries. • The `amcache` plugin returns proper ARP created install records. • A new `shophos` plugin supports parsing Sophos Home and Sophos Hitman data. • A new systemd journal plugin is added for Linux host analysis. • The `LogLoader` can now handle IIS logs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.6

Thu, 25 May 2023 09:21:56 GMT

Dissect 3.6 adds Parallels disk image filesystem support and Chromium-based browser extension plugins. • Adds `parallels` filesystem support for mounting Parallels disk images • Adds new `chromium_extensions` plugin to extract data from Chromium-based browser extensions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.5

Fri, 24 Mar 2023 15:03:13 GMT

Dissect 3.5 adds `zcat`/`zless` to `target-shell`, new `target-info` tool, and broad new plugin support for logs and package managers. • Adds `zcat` & `zless` commands to `target-shell` to transparently decompress gzip and bzip2 compressed files without external tools • Introduces the `target-info` tool to quickly display useful information about a specified target • Adds new plugins for parsing Trend Micro Worry-Free AV/firewall logs, McAfee AV/firewall logs (SQLite), Apt/yum/zypper package manager files, and NGINX/Apache/Caddy webserver logs • Extends `Acquire` to capture Windows PCA files, Linux `/proc` and `/sys` filesystems, and McAfee SQLite AV and firewall logs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect

Dissect 3.4

Fri, 10 Feb 2023 13:04:08 GMT

Dissect 3.4 introduces first-party support for dissect.executable (ELF/PE/Mach-O) and dissect.squashfs (SquashFS images). • `dissect.squashfs` plugin now available as a standalone module in Dissect 3.4, adding support for mounting and inspecting SquashFS filesystem images. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dissect