Skip to content

Commit 474264a

Browse files
andreia-ocaHorofic
andcommitted
Update docs/source/projects/dissect.hypervisor/index.rst
Co-authored-by: Stefan de Reuver <9864602+Horofic@users.noreply.github.com>
1 parent 46576a8 commit 474264a

1 file changed

Lines changed: 22 additions & 36 deletions

File tree

  • docs/source/projects/dissect.hypervisor

docs/source/projects/dissect.hypervisor/index.rst

Lines changed: 22 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -57,48 +57,34 @@ a VMDK for reading:
5757
Many of the parsers in this package behave in a very similar way, so check the API reference to see how to utilize the
5858
parser you need.
5959

60-
Open QCOW2 snapshots
61-
~~~~~~~~~~~~~~~~~~~~
60+
Opening QCOW2 disks & backing-files
61+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
6262

63-
For `qcow2` images there is support for backing-files and it can either be automatically loaded when opening a target.
64-
The backing-file will automatically be read from the `qcow2` headers and dissect will attempt to load it.
63+
The QCOW2 parser provided by this library can be used to open QCOW2 disk images, including snapshots and backing-files.
64+
When opening a QCOW2 image as a target, any backing-files are automatically loaded and resolved.
65+
66+
For example, to open a QCOW2 image along with its backing-file:
6567

6668
.. code-block:: python
67-
target = Target.open(target_path)
68-
print(target.users())
6969
70-
Or, for more control, the path to the backing file can be passed when initializing a `qcow2` disk:
70+
from dissect.hypervisor.disk.qcow2 import QCow2
71+
72+
with open("/path/to/base-image.qcow2", "rb") as base_image, \
73+
open("/path/to/backing-file.qcow2", "rb") as backing_file:
74+
qcow2 = QCow2(base_image, backing_file=backing_file)
75+
76+
print(qcow2.open().read(512))
77+
print(qcow2.backing_file.read(512))
78+
79+
When opening a QCOW2 image using the dissect.target :class:`~dissect.target.target.Target` class, any backing-files
80+
are automatically loaded and resolved. For example:
7181

7282
.. code-block:: python
73-
def open_qcow2_with_backing_file(snapshot_path: Path, backing_path: Path):
74-
# Open base QCOW2 image
75-
backing_fh = backing_path.open("rb")
76-
base_qcow2 = qcow2.QCow2(backing_fh)
77-
base_stream = base_qcow2.open()
78-
79-
# Open snapshot QCOW2 image with base as backing file
80-
snapshot_fh = snapshot_path.open("rb")
81-
snapshot_qcow2 = qcow2.QCow2(
82-
snapshot_fh,
83-
backing_file=base_stream
84-
)
85-
snapshot_stream = snapshot_qcow2.open()
86-
87-
return snapshot_stream, snapshot_fh, backing_fh, base_stream
88-
89-
def analyze_image(snapshot_path: Path, backing_path: Path):
90-
# Open the QCOW2 snapshot along with its backing file and get file/stream handles
91-
snapshot_stream, snapshot_fh, backing_fh, base_stream = open_qcow2_with_backing_file(snapshot_path, backing_path)
92-
93-
# Create a new Dissect target to analyze the disk image
94-
target = Target()
95-
# Add the snapshot stream to the target’s disks
96-
target.disks.add(snapshot_stream)
97-
# Resolve all disks, volumes and filesystems and load an operating system on the current
98-
target.apply()
99-
100-
# Collect data from the snapshot
101-
print(target.users())
83+
84+
from dissect.target import Target
85+
86+
target = Target("/path/to/base-image.qcow2") # Automatically resolves backing-files
87+
print(target.hostname)
10288
10389
Tools
10490
-----

0 commit comments

Comments
 (0)