acquire 3.7.dev2__tar.gz → 3.7.dev4__tar.gz

{acquire-3.7.dev2/acquire.egg-info → acquire-3.7.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: acquire
-Version: 3.7.dev2
+Version: 3.7.dev4
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{acquire-3.7.dev2 → acquire-3.7.dev4}/acquire/acquire.py

@@ -946,6 +946,7 @@ class QuarantinedFiles(Module):
         # Sophos
         ("glob", "sysvol/ProgramData/Sophos/Sophos/*/Quarantine"),
         ("glob", "sysvol/ProgramData/Sophos/Sophos */INFECTED"),
+        ("dir", "sysvol/ProgramData/Sophos/Safestore"),
         # HitmanPRO
         ("dir", "sysvol/ProgramData/HitmanPro/Quarantine"),
     ]

{acquire-3.7.dev2 → acquire-3.7.dev4}/acquire/tools/decrypter.py

@@ -8,7 +8,8 @@ import multiprocessing
 import os
 import signal
 import sys
-from collections import deque
+import textwrap
+from collections import defaultdict, deque
 from concurrent.futures import ProcessPoolExecutor
 from datetime import datetime, timezone
 from pathlib import Path
@@ -343,19 +344,20 @@ def main():
     if not progress:
         log.info("`rich` is not installed, progress will not be shown")
 
-    if args.output and len(args.files) > 1:
-        parser.exit("--output is only allowed when decrypting a single file")
+    if args.output and args.output.is_file() and len(args.files) > 1:
+        parser.exit("--output should be a directory when decrypting multiple files.")
 
-    if not args.output:
-        for path in args.files:
-            if path.suffix != ".enc":
-                parser.exit(f"File doesn't have .enc extension: {path}")
+    files = find_enc_files(args.files)
 
     if args.output:
-        outputs = [args.output.resolve()]
+        resolv_path = args.output.resolve()
+        outputs = [resolv_path / path.stem for path in files] if args.output.is_dir() else [resolv_path]
     else:
         # Strip .enc extension
-        outputs = [path.with_suffix("") for path in args.files]
+        outputs = [path.with_suffix("") for path in files]
+
+    if len(set(outputs)) != len(outputs):
+        show_duplicates(args.output, files)
 
     if not args.key_file and not args.key_server:
         parser.exit("Need either --key-file or --key-server")
@@ -378,7 +380,7 @@ def main():
             status_queue = mp.Queue()
             tasks = []
 
-            for in_path, out_path in zip(args.files, outputs):
+            for in_path, out_path in zip(files, outputs):
                 task_id = (
                     progress.add_task("decrypt", start=False, visible=False, filename=in_path.name)
                     if progress
@@ -424,6 +426,41 @@ def main():
                     break
 
 
+def show_duplicates(output_directory: Path, files: list[Path]) -> None:
+    # Gather all files that could cause duplicates in `args.output`.
+    input_files = defaultdict(list)
+    for input_file in files:
+        input_files[input_file.name].append(input_file)
+
+    # Find all duplicates
+    duplicate_generator = (file_paths for file_paths in input_files.values() if len(file_paths) > 1)
+    duplicates = "\n\n".join(
+        textwrap.indent(
+            "\n".join(str(file) for file in file_paths),
+            prefix="  - ",
+        )
+        for file_paths in duplicate_generator
+    )
+    log.warning(
+        "Two or more encrypted files have the same name. "
+        f"This will skip decrypting the file if it already exists in '{output_directory}'\n"
+        f"The files with the same names are:\n"
+        f"{duplicates}"
+    )
+
+
+def find_enc_files(files: list[Path]) -> list[Path]:
+    encrypted_files = []
+    for path in files:
+        if path.is_file() and path.suffix == ".enc":
+            encrypted_files.append(path)
+        elif path.is_dir():
+            encrypted_files.extend(path.rglob("*.enc"))
+        else:
+            log.info(f"File {path!r} does not have the .enc extension. skipping.")
+    return encrypted_files
+
+
 if __name__ == "__main__":
     try:
         sys.exit(main())

acquire-3.7.dev4/acquire/version.py

@@ -0,0 +1,4 @@
+# file generated by setuptools_scm
+# don't change, don't track in version control
+__version__ = version = '3.7.dev4'
+__version_tuple__ = version_tuple = (3, 7, 'dev4')

{acquire-3.7.dev2 → acquire-3.7.dev4/acquire.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: acquire
-Version: 3.7.dev2
+Version: 3.7.dev4
 Summary: A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{acquire-3.7.dev2 → acquire-3.7.dev4}/acquire.egg-info/SOURCES.txt

@@ -41,6 +41,7 @@ tests/__init__.py
 tests/conftest.py
 tests/test_acquire_command.py
 tests/test_collector.py
+tests/test_decryptor_funcs.py
 tests/test_esxi_memory.py
 tests/test_file_sorting.py
 tests/test_minio_uploader.py

acquire-3.7.dev4/tests/test_decryptor_funcs.py

@@ -0,0 +1,28 @@
+from pathlib import Path
+
+from acquire.tools.decrypter import find_enc_files
+
+
+def test_find_non_encrypted_files(tmp_path: Path):
+    input_files = [tmp_path / "test", tmp_path / "help"]
+
+    for file in input_files:
+        file.touch()
+
+    assert find_enc_files(input_files) == []
+
+
+def test_find_inside_dir(tmp_path: Path):
+    output_path = tmp_path.joinpath("output/for/this/test")
+    output_path.mkdir(parents=True)
+
+    rel_path = output_path.relative_to(tmp_path)
+
+    expected_outputs = []
+
+    for directory in rel_path.parents:
+        searchable_file = tmp_path / directory / "test.enc"
+        searchable_file.touch()
+        expected_outputs.append(searchable_file)
+
+    assert sorted(find_enc_files([tmp_path])) == sorted(expected_outputs)

acquire-3.7.dev2/acquire/version.py

@@ -1,4 +0,0 @@
-# file generated by setuptools_scm
-# don't change, don't track in version control
-__version__ = version = '3.7.dev2'
-__version_tuple__ = version_tuple = (3, 7, 'dev2')