acquire 3.12.dev5__tar.gz → 3.12.dev7__tar.gz

{acquire-3.12.dev5/acquire.egg-info → acquire-3.12.dev7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: acquire
-Version: 3.12.dev5
+Version: 3.12.dev7
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{acquire-3.12.dev5 → acquire-3.12.dev7}/acquire/acquire.py

@@ -99,11 +99,11 @@ logging.raiseExceptions = False
 
 def misc_windows_user_homes(target: Target) -> Iterator[fsutil.TargetPath]:
     misc_dirs = {
-        ("windows/serviceprofiles/localservice", False),
-        ("windows/serviceprofiles/networkservice", False),
-        ("windows/system32/config/systemprofile", False),
-        ("users", True),
-        ("documents and settings", True),
+        ("Windows/ServiceProfiles/LocalService", False),
+        ("Windows/ServiceProfiles/NetworkService", False),
+        ("Windows/System32/config/systemprofile", False),
+        ("Users", True),
+        ("Documents and Settings", True),
     }
 
     for fs in target.fs.path().iterdir():
@@ -146,7 +146,7 @@ MISC_MAPPING = {
 def from_user_home(target: Target, path: str) -> Iterator[str]:
     try:
         for user_details in target.user_details.all_with_home():
-            yield normalize_path(target, user_details.home_path.joinpath(path))
+            yield normalize_path(target, user_details.home_path.joinpath(path), lower_case=False)
     except Exception as e:
         log.warning("Error occurred when requesting all user homes")
         log.debug("", exc_info=e)
@@ -937,6 +937,7 @@ class Misc(Module):
         ("glob", "sysvol/ProgramData/USOShared/Logs/System/*.etl"),
         ("glob", "sysvol/Windows/Logs/WindowsUpdate/WindowsUpdate*.etl"),
         ("glob", "sysvol/Windows/Logs/CBS/CBS*.log"),
+        ("dir", "sysvol/ProgramData/Microsoft/Search/Data/Applications/Windows"),
     ]
 
 

{acquire-3.12.dev5 → acquire-3.12.dev7}/acquire/collector.py

@@ -74,8 +74,14 @@ def serialize_path(path: Any) -> str:
 
     # Naive way to serialize TargetPath filesystem's metadata is
     # to rely on uniqueness of `path._fs` object
-    fs_id = id(path._fs)
-    return f"{path._fs.__type__}:{fs_id}:{path}"
+    fs = path._fs
+    fs_id = id(fs)
+    fs_type = fs.__type__
+    path = str(path)
+    if not fs.case_sensitive:
+        path = path.lower()
+
+    return f"{fs_type}:{fs_id}:{path}"
 
 
 @dataclass

{acquire-3.12.dev5 → acquire-3.12.dev7}/acquire/utils.py

@@ -371,13 +371,13 @@ def persist_execution_report(path: Path, report_data: dict) -> Path:
 SYSVOL_SUBST = re.compile(r"^(/\?\?/)?[cC]:")
 
 
-def normalize_path(target: Target, path: Path, resolve: bool = False) -> str:
+def normalize_path(target: Target, path: Path, resolve: bool = False, lower_case: bool = True) -> str:
     if resolve:
         path = path.resolve()
 
     path = path.as_posix()
 
-    if not target.fs.case_sensitive:
+    if not target.fs.case_sensitive and lower_case:
         path = path.lower()
 
     if target.os == "windows":

{acquire-3.12.dev5 → acquire-3.12.dev7}/acquire/version.py

@@ -12,5 +12,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '3.12.dev5'
-__version_tuple__ = version_tuple = (3, 12, 'dev5')
+__version__ = version = '3.12.dev7'
+__version_tuple__ = version_tuple = (3, 12, 'dev7')

{acquire-3.12.dev5 → acquire-3.12.dev7/acquire.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: acquire
-Version: 3.12.dev5
+Version: 3.12.dev7
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{acquire-3.12.dev5 → acquire-3.12.dev7}/tests/test_utils.py

@@ -296,77 +296,95 @@ def test_check_and_set_acquire_args_cagent():
 
 
 @pytest.mark.parametrize(
-    "path, resolve, norm_path, case_sensitive, os",
+    "path, resolve, lower_case, case_sensitive, os, result",
     [
         (
             pathlib.Path("/foo/bar"),
             False,
-            "/foo/bar",
+            True,
             True,
             "dummy",
+            "/foo/bar",
         ),
         (
             pathlib.Path("/foo/BAR"),
             False,
-            "/foo/bar",
+            True,
             False,
             "dummy",
+            "/foo/bar",
         ),
         (
             pathlib.Path("/foo/BAR"),
             False,
-            "/foo/BAR",
+            True,
             True,
             "dummy",
+            "/foo/BAR",
         ),
         (
             pathlib.Path("/foo/../bar"),
             False,
-            "/foo/../bar",
+            True,
             True,
             "dummy",
+            "/foo/../bar",
         ),
         (
             pathlib.Path("/foo/../foo/bar"),
             True,
-            "/foo/bar",
+            True,
             True,
             "dummy",
+            "/foo/bar",
         ),
         (
             pathlib.PureWindowsPath("c:\\foo\\bar"),
             False,
-            "sysvol/foo/bar",
+            True,
             False,
             "windows",
+            "sysvol/foo/bar",
         ),
         (
             pathlib.PureWindowsPath("C:\\foo\\bar"),
             False,
-            "sysvol/foo/bar",
+            True,
             False,
             "windows",
+            "sysvol/foo/bar",
         ),
         (
             pathlib.PureWindowsPath("\\??\\C:\\foo\\bar"),
             False,
-            "sysvol/foo/bar",
+            True,
             False,
             "windows",
+            "sysvol/foo/bar",
         ),
         (
             pathlib.PureWindowsPath("\\??\\c:\\foo\\bar"),
             False,
-            "sysvol/foo/bar",
+            True,
             False,
             "windows",
+            "sysvol/foo/bar",
         ),
         (
             pathlib.PureWindowsPath("D:\\foo\\bar"),
             False,
+            True,
+            False,
+            "windows",
             "d:/foo/bar",
+        ),
+        (
+            pathlib.PureWindowsPath("D:\\Foo\\BAR"),
+            False,
+            False,
             False,
             "windows",
+            "D:/Foo/BAR",
         ),
     ],
 )
@@ -374,16 +392,17 @@ def test_utils_normalize_path(
     mock_target: Target,
     path: pathlib.Path,
     resolve: bool,
-    norm_path: str,
+    lower_case: bool,
     case_sensitive: bool,
     os: str,
+    result: str,
 ) -> None:
     with patch.object(mock_target, "os", new=os), patch.object(mock_target.fs, "_case_sensitive", new=case_sensitive):
-        resolved_path = normalize_path(mock_target, path, resolve=resolve)
+        resolved_path = normalize_path(mock_target, path, resolve=resolve, lower_case=lower_case)
 
         if platform.system() == "Windows":
             # A resolved path on windows adds a C:\ prefix. So we check if it ends with our expected
             # path string
-            assert resolved_path.endswith(norm_path)
+            assert resolved_path.endswith(result)
         else:
-            assert resolved_path == norm_path
+            assert resolved_path == result