acquire 3.18.dev2__tar.gz → 3.18.dev4__tar.gz

{acquire-3.18.dev2/acquire.egg-info → acquire-3.18.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: acquire
-Version: 3.18.dev2
+Version: 3.18.dev4
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{acquire-3.18.dev2 → acquire-3.18.dev4}/acquire/acquire.py

@@ -770,6 +770,35 @@ class Exchange(Module):
         return spec
 
 
+@register_module("--mssql")
+class MSSQL(Module):
+    DESC = "MSSQL error logs"
+
+    SPEC = [("glob", "/var/opt/mssql/log/errorlog*")]
+
+    @classmethod
+    def get_spec_additions(cls, target: Target, cli_args: argparse.Namespace) -> Iterator[tuple[str, str]]:
+        log_paths = set()
+
+        if not target.has_function("registry"):
+            return
+
+        for reg_key in target.registry.glob_ext("HKLM\\SOFTWARE\\Microsoft\\Microsoft SQL Server\\*"):
+            try:
+                log_paths.add(reg_key.value("ErrorDumpDir").value)
+            except Exception:
+                pass
+
+            try:
+                subkey = reg_key.subkey("CPE")
+                log_paths.add(subkey.value("ErrorDumpDir").value)
+            except Exception:
+                pass
+
+        for log_path in log_paths:
+            yield ("glob", f"{log_path}/ERRORLOG*")
+
+
 @register_module("--iis")
 class IIS(Module):
     DESC = "IIS logs"
@@ -1307,6 +1336,8 @@ class Boot(Module):
         ("glob", "/boot/grub*"),
         ("glob", "/boot/init*"),
         ("glob", "/boot/system*"),
+        # Proxmox specific file
+        ("glob", "/boot/pve*"),
     ]
 
 
@@ -1410,6 +1441,10 @@ class Var(Module):
         ("dir", "/var/audit"),
         ("dir", "/var/cron"),
         ("dir", "/var/run"),
+        # Proxmox specific files
+        ("dir", "/var/lib/pve-cluster"),
+        ("dir", "/var/lib/pve-firewall"),
+        ("dir", "/var/lib/pve-manager"),
         # some OS-X specific files
         ("dir", "/private/var/at"),
         ("dir", "/private/var/db/diagnostics"),
@@ -1978,6 +2013,7 @@ class WindowsProfile:
         IIS,
         TextEditor,
         Docker,
+        MSSQL,
     ]
 
 
@@ -1995,6 +2031,7 @@ class LinuxProfile:
         Docker,
         History,
         WebHosting,
+        MSSQL,
     ]
 
 
@@ -2041,6 +2078,22 @@ class OSXProfile:
     ]
 
 
+class ProxmoxProfile:
+    MINIMAL = [
+        Etc,
+        Boot,
+        Home,
+        SSH,
+        Var,
+    ]
+    DEFAULT = MINIMAL
+    FULL = [
+        *DEFAULT,
+        History,
+        WebHosting,
+    ]
+
+
 PROFILES = {
     "full": {
         "windows": WindowsProfile.FULL,
@@ -2048,6 +2101,7 @@ PROFILES = {
         "bsd": BsdProfile.FULL,
         "esxi": ESXiProfile.FULL,
         "osx": OSXProfile.FULL,
+        "proxmox": ProxmoxProfile.FULL,
     },
     "default": {
         "windows": WindowsProfile.DEFAULT,
@@ -2055,6 +2109,7 @@ PROFILES = {
         "bsd": BsdProfile.DEFAULT,
         "esxi": ESXiProfile.DEFAULT,
         "osx": OSXProfile.DEFAULT,
+        "proxmox": ProxmoxProfile.DEFAULT,
     },
     "minimal": {
         "windows": WindowsProfile.MINIMAL,
@@ -2062,6 +2117,7 @@ PROFILES = {
         "bsd": BsdProfile.MINIMAL,
         "esxi": ESXiProfile.MINIMAL,
         "osx": OSXProfile.MINIMAL,
+        "proxmox": ProxmoxProfile.MINIMAL,
     },
     "none": None,
 }
@@ -2090,6 +2146,7 @@ VOLATILE = {
         "bsd": [],
         "esxi": [],
         "osx": [],
+        "proxmox": [],
     },
     "extensive": {
         "windows": VolatileProfile.DEFAULT,
@@ -2097,6 +2154,7 @@ VOLATILE = {
         "bsd": VolatileProfile.EXTENSIVE,
         "esxi": VolatileProfile.EXTENSIVE,
         "osx": [],
+        "proxmox": [],
     },
     "none": None,
 }

{acquire-3.18.dev2 → acquire-3.18.dev4}/acquire/version.py

@@ -12,5 +12,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '3.18.dev2'
-__version_tuple__ = version_tuple = (3, 18, 'dev2')
+__version__ = version = '3.18.dev4'
+__version_tuple__ = version_tuple = (3, 18, 'dev4')

{acquire-3.18.dev2 → acquire-3.18.dev4/acquire.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: acquire
-Version: 3.18.dev2
+Version: 3.18.dev4
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3