acquire 3.17.dev3__tar.gz → 3.17.dev5__tar.gz

{acquire-3.17.dev3/acquire.egg-info → acquire-3.17.dev5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: acquire
-Version: 3.17.dev3
+Version: 3.17.dev5
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{acquire-3.17.dev3 → acquire-3.17.dev5}/acquire/acquire.py

@@ -1372,6 +1372,26 @@ class SSH(Module):
             super().run(target, cli_args, collector)
 
 
+@register_module("--docker")
+class Docker(Module):
+    DESC = "various Docker logs and configuration files"
+    SPEC = [
+        # Container log files
+        ("glob", "/var/lib/docker/containers/*/*-json.log"),
+        ("glob", "/var/lib/docker/containers/*/*.json"),
+        ("glob", "/var/lib/docker/containers/*/hostname"),
+        # Linux daemon configs
+        ("file", "/etc/docker/daemon.json"),
+        ("file", "/var/snap/docker/current/config/daemon.json"),
+        # Windows daemon configs
+        ("file", "sysvol/ProgramData/docker/config/daemon.json"),
+        # User-specific config files (MacOS/Linux/Windows)
+        ("file", ".docker/daemon.json", from_user_home),
+        # Repositories
+        ("file", "/var/lib/docker/image/overlay2/repositories.json"),
+    ]
+
+
 @register_module("--var")
 class Var(Module):
     SPEC = [
@@ -1952,6 +1972,7 @@ class WindowsProfile:
         SSH,
         IIS,
         TextEditor,
+        Docker,
     ]
 
 
@@ -1966,6 +1987,7 @@ class LinuxProfile:
     DEFAULT = MINIMAL
     FULL = [
         *DEFAULT,
+        Docker,
         History,
         WebHosting,
     ]
@@ -2010,6 +2032,7 @@ class OSXProfile:
         *DEFAULT,
         History,
         SSH,
+        Docker,
     ]
 
 

{acquire-3.17.dev3 → acquire-3.17.dev5}/acquire/version.py

@@ -12,5 +12,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '3.17.dev3'
-__version_tuple__ = version_tuple = (3, 17, 'dev3')
+__version__ = version = '3.17.dev5'
+__version_tuple__ = version_tuple = (3, 17, 'dev5')

{acquire-3.17.dev3 → acquire-3.17.dev5/acquire.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: acquire
-Version: 3.17.dev3
+Version: 3.17.dev5
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{acquire-3.17.dev3 → acquire-3.17.dev5}/acquire/collector.py

@@ -518,6 +518,9 @@ class Collector:
                     self.report.add_symlink_collected(module_name, branch_path)
                     log.info("- Collecting symlink branch suceeded %s", branch_path)
 
+        except (FileNotFoundError, NotADirectoryError, NotASymlinkError, SymlinkRecursionError, ValueError):
+            self.report.add_path_missing(module_name, error_path)
+            log.error("- Path %s is not found (while collecting %s)", error_path, path)
         except OSError as error:
             if error.errno == errno.ENOENT:
                 self.report.add_path_missing(module_name, error_path)
@@ -528,9 +531,6 @@ class Collector:
             else:
                 self.report.add_path_failed(module_name, error_path)
                 log.error("- OSError while collecting path %s (while collecting %s)", error_path, path)
-        except (FileNotFoundError, NotADirectoryError, NotASymlinkError, SymlinkRecursionError, ValueError):
-            self.report.add_path_missing(module_name, error_path)
-            log.error("- Path %s is not found (while collecting %s)", error_path, path)
         except Exception:
             self.report.add_path_failed(module_name, error_path)
             log.error("- Failed to collect path %s (while collecting %s)", error_path, path, exc_info=True)