acquire 3.20.dev5__tar.gz → 3.20.dev7__tar.gz

{acquire-3.20.dev5 → acquire-3.20.dev7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: acquire
-Version: 3.20.dev5
+Version: 3.20.dev7
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{acquire-3.20.dev5 → acquire-3.20.dev7}/acquire/acquire.py

@@ -859,6 +859,24 @@ class IIS(Module):
         return spec
 
 
+@register_module("--sharepoint")
+class SharePoint(Module):
+    DESC = "Windows SharePoint Server logs"
+
+    @classmethod
+    def get_spec_additions(cls, target: Target, cli_args: argparse.Namespace) -> Iterator[tuple]:
+        spec = set()
+        key = "HKLM\\SOFTWARE\\Microsoft\\Shared Tools\\Web Server Extensions\\*\\WSS"
+
+        for reg_key in target.registry.glob_ext(key):
+            try:
+                spec.add(("path", reg_key.value("LogDir").value))
+            except Exception:  # noqa: PERF203
+                pass
+
+        return spec
+
+
 @register_module("--prefetch")
 class Prefetch(Module):
     DESC = "Windows Prefetch files"
@@ -1073,6 +1091,7 @@ class AV(Module):
         # McAfee
         ("path", "Application Data/McAfee/DesktopProtection", from_user_home),
         ("path", "sysvol/ProgramData/McAfee/DesktopProtection"),
+        ("path", "sysvol/ProgramData/McAfee/Endpoint Security/ATP"),
         ("path", "sysvol/ProgramData/McAfee/Endpoint Security/Logs"),
         ("path", "sysvol/ProgramData/McAfee/Endpoint Security/Logs_Old"),
         ("path", "sysvol/ProgramData/Mcafee/VirusScan"),
@@ -2113,6 +2132,7 @@ class WindowsProfile:
         WindowsNotifications,
         SSH,
         IIS,
+        SharePoint,
         TextEditor,
         Docker,
         MSSQL,

acquire-3.20.dev7/acquire/version.py

@@ -0,0 +1,34 @@
+# file generated by setuptools-scm
+# don't change, don't track in version control
+
+__all__ = [
+    "__version__",
+    "__version_tuple__",
+    "version",
+    "version_tuple",
+    "__commit_id__",
+    "commit_id",
+]
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from typing import Tuple
+    from typing import Union
+
+    VERSION_TUPLE = Tuple[Union[int, str], ...]
+    COMMIT_ID = Union[str, None]
+else:
+    VERSION_TUPLE = object
+    COMMIT_ID = object
+
+version: str
+__version__: str
+__version_tuple__: VERSION_TUPLE
+version_tuple: VERSION_TUPLE
+commit_id: COMMIT_ID
+__commit_id__: COMMIT_ID
+
+__version__ = version = '3.20.dev7'
+__version_tuple__ = version_tuple = (3, 20, 'dev7')
+
+__commit_id__ = commit_id = 'gc243af820'

{acquire-3.20.dev5 → acquire-3.20.dev7}/acquire.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: acquire
-Version: 3.20.dev5
+Version: 3.20.dev7
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

acquire-3.20.dev5/acquire/version.py

@@ -1,21 +0,0 @@
-# file generated by setuptools-scm
-# don't change, don't track in version control
-
-__all__ = ["__version__", "__version_tuple__", "version", "version_tuple"]
-
-TYPE_CHECKING = False
-if TYPE_CHECKING:
-    from typing import Tuple
-    from typing import Union
-
-    VERSION_TUPLE = Tuple[Union[int, str], ...]
-else:
-    VERSION_TUPLE = object
-
-version: str
-__version__: str
-__version_tuple__: VERSION_TUPLE
-version_tuple: VERSION_TUPLE
-
-__version__ = version = '3.20.dev5'
-__version_tuple__ = version_tuple = (3, 20, 'dev5')