search

Velocidex / velociraptor

Digging Deeper....
https://docs.velociraptor.app/
Other
2.86k stars 478 forks source link

"auto" accessor doesn't work as expected on Windows x86 #3600

Open hunt3vil opened 2 months ago

hunt3vil commented 2 months ago

We use an offline collector with the KapeFiles artifact. With default configuration the collector uses lazy_ntfs for registry hives and does not pull Windows\System32\config\SOFTWARE for example. However, when I changed the accessor to ntfs the collector correctly pulled the SOFTWARE registry hive file.

scudette commented 1 month ago

This is interesting as the lazy_ntfs is just an alias to the regular ntfs accessor these days (they used to be different in the distant past).

https://github.com/Velocidex/velociraptor/blob/5cc893a3e507a271037f7ff32e095a4025ce8af6/accessors/ntfs/ntfs_accessor_windows.go#L184

hunt3vil commented 1 month ago

OK. So my report is incorrect because inside the KapeFile artifact it is the "auto" accessor that is used by default for everything set to "lazy_ntfs". Updated the issue title