:py:mod:`dissect.target.plugins.child.wsl`
==========================================

.. py:module:: dissect.target.plugins.child.wsl


Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.target.plugins.child.wsl.WSLChildTargetPlugin



Functions
~~~~~~~~~

.. autoapisummary::
   :nosignatures:

   dissect.target.plugins.child.wsl.find_wsl_installs



.. py:function:: find_wsl_installs(target: dissect.target.target.Target) -> Iterator[pathlib.Path]

   Find all WSL disk files.

   Disk files for working (custom) Linux distributions can be located anywhere on the system.
   Locations to disk files for each user's WSL instance is stored in the Windows registry at
   ``HKCU\Software\Microsoft\Windows\CurrentVersion\Lxss``.

   .. rubric:: References

   - https://learn.microsoft.com/en-us/windows/wsl/use-custom-distro
   - https://learn.microsoft.com/en-us/windows/wsl/enterprise


.. py:class:: WSLChildTargetPlugin(target: dissect.target.target.Target)


   Bases: :py:obj:`dissect.target.plugin.ChildTargetPlugin`

   Child target plugin that yields WSL VHDX file locations.

   Windows WSL VHDX disk file locations are stored in the Windows registry in ``HKCU\Software\Microsoft\Windows\CurrentVersion\Lxss``.

   .. rubric:: References

   - https://www.osdfcon.org/presentations/2020/Asif-Matadar_Investigating-WSL-Endpoints.pdf
   - https://www.sans.org/white-papers/39330/
   - https://learn.microsoft.com/en-us/windows/wsl/disk-space#how-to-locate-the-vhdx-file-and-disk-path-for-your-linux-distribution

   .. py:attribute:: __type__
      :value: 'wsl'

      

   .. py:method:: check_compatible() -> None

      Perform a compatibility check with the target.

      This function should return ``None`` if the plugin is compatible with
      the current target (``self.target``). For example, check if a certain
      file exists.
      Otherwise it should raise an ``UnsupportedPluginError``.

      :raises UnsupportedPluginError: If the plugin could not be loaded.


   .. py:method:: list_children() -> Iterator[dissect.target.helpers.record.ChildTargetRecord]

      Yield :class:`~dissect.target.helpers.record.ChildTargetRecord` records of all
      possible child targets on this target.