-
Notifications
You must be signed in to change notification settings - Fork 35
Description
When acquiring any non-live Windows container (HDD, VM image) from Linux with case-sensitive filesystem output tar/directory contains duplicate directories with mixed case:
For example, running acquire windows-vm.qcow2
on Linux with btrfs gives following directories (truncated for readability):
$ tree
.
└── C:
├── $Recycle.bin
├── $Recycle.Bin
├── windows
│ ├── appcompat
│ ├── system32
│ │ ├── config
│ │ ├── drivers
│ │ ├── sru
│ │ ├── tasks
│ │ ├── wbem
│ │ └── winevt
│ └── tasks
└── Windows
└── System32
└── WDI
Notice duplicated $Recycle.Bin
, Windows
, System32
directories with different case.
I managed to somewhat fix it with replacing all sysvol/windows/
and /sysvol/windows/system32
strings in acquire.py
with proper case, but this method also requires similar changes in other dissect libraries, since acquire
calls them to get collection paths. Surely there are a better fix for this than specifying correct case in collection paths, e.g. using proper path from filesystem for output path