search

fox-it / acquire

acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.
GNU Affero General Public License v3.0
91 stars 26 forks source link

New collection and de-duplication logic #161

Closed pyrco closed 7 months ago

pyrco commented 8 months ago

When paths contain intermediate symlinks, these intermediate symlinks are collected instead of collecting the unresolved path as is. De-duplication between sysvol and it's equivalent drive letter path is done properly. Collecting of special files (e.g. MFT, Recyclebin etc.) is properly abstracted.

(DIS-1222)

codecov-commenter commented 8 months ago

Codecov Report

Attention: Patch coverage is 63.43284% with 98 lines in your changes are missing coverage. Please review.

Project coverage is 43.02%. Comparing base (36ab928) to head (3e2526c).

Files Patch % Lines
acquire/acquire.py 14.49% 59 Missing :warning:
acquire/collector.py 79.03% 39 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #161 +/- ## ========================================== + Coverage 41.72% 43.02% +1.29% ========================================== Files 26 26 Lines 3276 3312 +36 ========================================== + Hits 1367 1425 +58 + Misses 1909 1887 -22 ``` | [Flag](https://app.codecov.io/gh/fox-it/acquire/pull/161/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=fox-it) | Coverage Δ | | |---|---|---| | [unittests](https://app.codecov.io/gh/fox-it/acquire/pull/161/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=fox-it) | `43.02% <63.43%> (+1.29%)` | :arrow_up: | Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=fox-it#carryforward-flags-in-the-pull-request-comment) to find out more.

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

pyrco commented 7 months ago

My output also sometimes has mixed drive letter capitalization, notably for the PowerShell history and Startup LNK files. Ideally we normalize that too.

That is the same issue as generic path name uniformization. So see my comment about that.