Following up on https://github.com/Velocidex/velociraptor/issues/3597 (with respect to Dissect Acquire collects), I am now able to remap the filesystem using remapping configuration, but remapping registry hives inside the collects still give me case sensitiveness issues
This remapping works if the zip file "acquire-collect.zip" contains the file "fs/C:/Windows/System32/config/SYSTEM" but fails to work if the casing deviates ("fs/C:/windows/system32/config/system").
Does this has something to do with the fact that there is more delegation here?
About environment: I pulled the main branch, build velociraptor and test this using the artifact Windows.Registry.AppCompatCache and a sample collect made by Dissect acquire
Following up on https://github.com/Velocidex/velociraptor/issues/3597 (with respect to Dissect Acquire collects), I am now able to remap the filesystem using remapping configuration, but remapping registry hives inside the collects still give me case sensitiveness issues
Given the following (partial) config
This remapping works if the zip file "acquire-collect.zip" contains the file "fs/C:/Windows/System32/config/SYSTEM" but fails to work if the casing deviates ("fs/C:/windows/system32/config/system").
Does this has something to do with the fact that there is more delegation here?
About environment: I pulled the main branch, build velociraptor and test this using the artifact
Windows.Registry.AppCompatCache
and a sample collect made by Dissect acquire