acquire 3.20.dev3__tar.gz → 3.20.dev5__tar.gz

{acquire-3.20.dev3 → acquire-3.20.dev5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: acquire
-Version: 3.20.dev3
+Version: 3.20.dev5
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{acquire-3.20.dev3 → acquire-3.20.dev5}/acquire/acquire.py

@@ -1333,6 +1333,9 @@ class RemoteAccess(Module):
         ("path", "sysvol/ProgramData/TightVNC/Server/Logs"),
         # Remote desktop cache files
         ("path", "AppData/Local/Microsoft/Terminal Server Client/Cache", from_user_home),
+        # Splashtop
+        ("path", "sysvol/ProgramData/Splashtop/Temp/log"),
+        ("path", "sysvol/Program Files (x86)/Splashtop/Splashtop Remote/Server/log"),
     )
 
 
@@ -1897,13 +1900,16 @@ def acquire_target(target: Target, args: argparse.Namespace, output_ts: str | No
     print_acquire_warning(target)
 
     modules_selected = {}
+    modules_disabled = []
     modules_successful = []
     modules_failed = {}
     for name, mod in MODULES.items():
         name_slug = name.lower()
         # check if module was set in the arguments provided
-        if getattr(args, name_slug):
+        if (mod_arg := getattr(args, name_slug)) is True:
             modules_selected[name] = mod
+        elif mod_arg is False:
+            modules_disabled.append(name)
 
     profile = args.profile
 
@@ -1926,6 +1932,10 @@ def acquire_target(target: Target, args: argparse.Namespace, output_ts: str | No
     )
     modules_selected.update(volatile_modules)
 
+    # Filter modules that are explicitly disabled
+    for name in modules_disabled:
+        modules_selected.pop(name, None)
+
     if not modules_selected:
         log.warning("NO modules selected!")
     else:

{acquire-3.20.dev3 → acquire-3.20.dev5}/acquire/version.py

@@ -17,5 +17,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '3.20.dev3'
-__version_tuple__ = version_tuple = (3, 20, 'dev3')
+__version__ = version = '3.20.dev5'
+__version_tuple__ = version_tuple = (3, 20, 'dev5')

{acquire-3.20.dev3 → acquire-3.20.dev5}/acquire.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: acquire
-Version: 3.20.dev3
+Version: 3.20.dev5
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3