acquire 3.18.dev3__tar.gz → 3.18.dev5__tar.gz

{acquire-3.18.dev3/acquire.egg-info → acquire-3.18.dev5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: acquire
-Version: 3.18.dev3
+Version: 3.18.dev5
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{acquire-3.18.dev3 → acquire-3.18.dev5}/acquire/acquire.py

@@ -770,6 +770,35 @@ class Exchange(Module):
         return spec
 
 
+@register_module("--mssql")
+class MSSQL(Module):
+    DESC = "MSSQL error logs"
+
+    SPEC = [("glob", "/var/opt/mssql/log/errorlog*")]
+
+    @classmethod
+    def get_spec_additions(cls, target: Target, cli_args: argparse.Namespace) -> Iterator[tuple[str, str]]:
+        log_paths = set()
+
+        if not target.has_function("registry"):
+            return
+
+        for reg_key in target.registry.glob_ext("HKLM\\SOFTWARE\\Microsoft\\Microsoft SQL Server\\*"):
+            try:
+                log_paths.add(reg_key.value("ErrorDumpDir").value)
+            except Exception:
+                pass
+
+            try:
+                subkey = reg_key.subkey("CPE")
+                log_paths.add(subkey.value("ErrorDumpDir").value)
+            except Exception:
+                pass
+
+        for log_path in log_paths:
+            yield ("glob", f"{log_path}/ERRORLOG*")
+
+
 @register_module("--iis")
 class IIS(Module):
     DESC = "IIS logs"
@@ -1984,6 +2013,7 @@ class WindowsProfile:
         IIS,
         TextEditor,
         Docker,
+        MSSQL,
     ]
 
 
@@ -2001,6 +2031,7 @@ class LinuxProfile:
         Docker,
         History,
         WebHosting,
+        MSSQL,
     ]
 
 

{acquire-3.18.dev3 → acquire-3.18.dev5}/acquire/tools/decrypter.py

@@ -374,7 +374,7 @@ def setup_logging(logger: logging.Logger, verbosity: int) -> None:
     logger.setLevel(level)
 
 
-def main() -> None:
+def main() -> int:
     parser = argparse.ArgumentParser()
     parser.add_argument("files", nargs="+", type=Path, help="paths to encrypted files")
     parser.add_argument("-o", "--output", type=Path, help="optional path to output file")
@@ -496,7 +496,8 @@ def main() -> None:
             # Else, if all were successful but there were still tasks to handle, return 3
             elif tasks:
                 exit_code = 3
-    exit(exit_code)
+
+    return exit_code
 
 
 def show_duplicates(output_directory: Path, files: list[Path]) -> None:

{acquire-3.18.dev3 → acquire-3.18.dev5}/acquire/version.py

@@ -12,5 +12,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '3.18.dev3'
-__version_tuple__ = version_tuple = (3, 18, 'dev3')
+__version__ = version = '3.18.dev5'
+__version_tuple__ = version_tuple = (3, 18, 'dev5')

{acquire-3.18.dev3 → acquire-3.18.dev5/acquire.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: acquire
-Version: 3.18.dev3
+Version: 3.18.dev5
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3