acquire 3.18.dev6__tar.gz → 3.18.dev9__tar.gz

acquire-3.18.dev9/.git-blame-ignore-revs

@@ -0,0 +1,6 @@
+# Formatting commits. You can ignore them during git-blame with `--ignore-rev` or `--ignore-revs-file`.
+#
+#   $ git config --add 'blame.ignoreRevsFile' '.git-blame-ignore-revs'
+#
+# Change linter to Ruff (#213)
+9223cf135e3a95cf9687a01c745b9b6740459296

acquire-3.18.dev9/.gitattributes

@@ -0,0 +1 @@
+tests/_data/** filter=lfs diff=lfs merge=lfs -text

{acquire-3.18.dev6/acquire.egg-info → acquire-3.18.dev9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: acquire
-Version: 3.18.dev6
+Version: 3.18.dev9
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{acquire-3.18.dev6 → acquire-3.18.dev9}/acquire/acquire.py

@@ -302,6 +302,18 @@ class Proc(Module):
         collector.collect(spec, follow=False, volatile=True)
 
 
+@register_module("--proc-net")
+@local_module
+class ProcNet(Module):
+    DESC = "Procfs network files (live systems only)"
+    EXEC_ORDER = ExecutionOrder.BOTTOM
+
+    @classmethod
+    def _run(cls, target: Target, cli_args: argparse.Namespace, collector: Collector) -> None:
+        spec = [("dir", "/proc/net")]
+        collector.collect(spec, follow=False, volatile=True)
+
+
 @register_module("-n", "--ntfs")
 class NTFS(Module):
     DESC = "NTFS filesystem metadata"
@@ -2090,27 +2102,28 @@ class VolatileProfile:
         WinArpCache,
         WinRDPSessions,
         WinDnsClientCache,
+        ProcNet,
     )
-    EXTENSIVE = (
+    FULL = (
         Proc,
         Sys,
     )
 
 
 VOLATILE = {
-    "default": {
+    "full": {
         "windows": VolatileProfile.DEFAULT,
-        "linux": [],
-        "bsd": [],
-        "esxi": [],
+        "linux": VolatileProfile.FULL,
+        "bsd": VolatileProfile.FULL,
+        "esxi": VolatileProfile.FULL,
         "osx": [],
         "proxmox": [],
     },
-    "extensive": {
+    "default": {
         "windows": VolatileProfile.DEFAULT,
-        "linux": VolatileProfile.EXTENSIVE,
-        "bsd": VolatileProfile.EXTENSIVE,
-        "esxi": VolatileProfile.EXTENSIVE,
+        "linux": [],
+        "bsd": [],
+        "esxi": [],
         "osx": [],
         "proxmox": [],
     },

{acquire-3.18.dev6 → acquire-3.18.dev9}/acquire/collector.py

@@ -330,13 +330,10 @@ class Collector:
                          used.
             base: A different base path to use to store the file, it is prepended to the given or
                   generated ``outpath``.
-            volatile: When this flag is set, the collection of a number of artefacts is done
-                      slightly different:
-                      - symlinks at the end of a path will not be collected,
-                      - empty directories will be collected,
-                      - files will be collected in a slower but more robust way, any errors while
-                        reading the bytes will not fail the collection of the file and all bytes
-                        already retrieved will be stored.
+            volatile: When this flag is set, the collection of a number of artefacts is performed slightly different.
+                      Symlinks at the end of a path will not be collected, empty directories will be collected,
+                      files will be collected in a slower but more robust way, any errors while reading the bytes
+                      will not fail the collection of the file and all bytes already retrieved will be stored.
             seen_paths: A list of normalized path strings, used when calling this function
                         recursively to collect directories to break out of symlink loops.
         """

{acquire-3.18.dev6 → acquire-3.18.dev9}/acquire/gui/win32.py

@@ -83,7 +83,6 @@ PBM_SETRANGE32 = WM_USER + 6
 PBS_SMOOTH = 0x01
 BN_CLICKED = 0
 BM_SETCHECK = 241
-WHITE_BRUSH = 0
 WM_CTLCOLORSTATIC = 312
 SS_LEFT = 0
 

{acquire-3.18.dev6 → acquire-3.18.dev9}/acquire/hashes.py

@@ -162,7 +162,8 @@ def collect_hashes(
     Walk through the paths, calculate hashes and return details per path.
 
     Spec contains a path selector and a list of hash functions to compute against the paths.
-    For example:
+    For example::
+
         [
             ("dir", ("sysvol/Windows/", ("exe", "dll", "sys"))),
             (HashFunc.MD5, HashFunc.SHA1)

{acquire-3.18.dev6 → acquire-3.18.dev9}/acquire/version.py

@@ -12,5 +12,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '3.18.dev6'
-__version_tuple__ = version_tuple = (3, 18, 'dev6')
+__version__ = version = '3.18.dev9'
+__version_tuple__ = version_tuple = (3, 18, 'dev9')

{acquire-3.18.dev6 → acquire-3.18.dev9/acquire.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: acquire
-Version: 3.18.dev6
+Version: 3.18.dev9
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{acquire-3.18.dev6 → acquire-3.18.dev9}/acquire.egg-info/SOURCES.txt

@@ -1,3 +1,5 @@
+.git-blame-ignore-revs
+.gitattributes
 COPYRIGHT
 LICENSE
 MANIFEST.in
@@ -59,8 +61,9 @@ tests/test_outputs_zip.py
 tests/test_plugin.py
 tests/test_utils.py
 tests/test_volatile.py
-tests/data/private_key.pem
-tests/data/public_key.pem
-tests/docs/Makefile
-tests/docs/conf.py
-tests/docs/index.rst
+tests/_data/private_key.pem
+tests/_data/public_key.pem
+tests/_docs/Makefile
+tests/_docs/__init__.py
+tests/_docs/conf.py
+tests/_docs/index.rst

{acquire-3.18.dev6/tests/docs → acquire-3.18.dev9/tests/_docs}/Makefile

@@ -3,7 +3,7 @@
 
 # You can set these variables from the command line, and also
 # from the environment for the first two.
-SPHINXOPTS    ?= -jauto
+SPHINXOPTS    ?= -jauto -w $(BUILDDIR)/warnings.log --fail-on-warning
 SPHINXBUILD   ?= sphinx-build
 SOURCEDIR     = .
 BUILDDIR      = build

{acquire-3.18.dev6/tests/docs → acquire-3.18.dev9/tests/_docs}/conf.py

@@ -1,3 +1,5 @@
+project = "acquire"
+
 extensions = [
     "autoapi.extension",
     "sphinx.ext.autodoc",
@@ -32,3 +34,8 @@ autodoc_typehints = "signature"
 autodoc_member_order = "groupwise"
 
 autosectionlabel_prefix_document = True
+
+suppress_warnings = [
+    # https://github.com/readthedocs/sphinx-autoapi/issues/285
+    "autoapi.python_import_resolution",
+]

{acquire-3.18.dev6 → acquire-3.18.dev9}/tests/conftest.py

@@ -40,4 +40,4 @@ def mock_target(mock_fs: VirtualFilesystem) -> Target:
 
 @pytest.fixture
 def public_key() -> str:
-    return Path("tests/data/public_key.pem").read_text()
+    return Path("tests/_data/public_key.pem").read_text()

{acquire-3.18.dev6 → acquire-3.18.dev9}/tests/test_outputs_tar.py

@@ -56,7 +56,7 @@ def test_tar_output_encrypt(mock_fs: VirtualFilesystem, public_key: bytes, tmp_p
     tar_output.write_entry(entry_name, entry)
     tar_output.close()
 
-    encrypted_stream = EncryptedFile(tar_output.path.open("rb"), Path("tests/data/private_key.pem"))
+    encrypted_stream = EncryptedFile(tar_output.path.open("rb"), Path("tests/_data/private_key.pem"))
     decrypted_path = tmp_path / "decrypted.tar"
     # Direct streaming is not an option because tarfile needs seek when reading from encrypted files directly
     Path(decrypted_path).write_bytes(encrypted_stream.read())

{acquire-3.18.dev6 → acquire-3.18.dev9}/tests/test_outputs_zip.py

@@ -60,7 +60,7 @@ def test_zip_output_encrypt(mock_fs: VirtualFilesystem, public_key: bytes, tmp_p
     zip_output.write_entry(entry_name, entry)
     zip_output.close()
 
-    encrypted_stream = EncryptedFile(zip_output.path.open("rb"), Path("tests/data/private_key.pem"))
+    encrypted_stream = EncryptedFile(zip_output.path.open("rb"), Path("tests/_data/private_key.pem"))
     decrypted_path = tmp_path / "decrypted.zip"
     # Direct streaming is not an option because zipfile needs seek when reading from encrypted files directly
     Path(decrypted_path).write_bytes(encrypted_stream.read())

{acquire-3.18.dev6 → acquire-3.18.dev9}/tox.ini

@@ -55,12 +55,12 @@ deps =
     sphinx-design
     furo
 commands =
-    make -C tests/docs clean
-    make -C tests/docs html
+    make -C tests/_docs clean
+    make -C tests/_docs html
 
 [testenv:docs-linkcheck]
 allowlist_externals = make
 deps = {[testenv:docs-build]deps}
 commands =
-    make -C tests/docs clean
-    make -C tests/docs linkcheck
+    make -C tests/_docs clean
+    make -C tests/_docs linkcheck