Skip to content

Inconsistent output paths when acquiring Windows container from Linux #171

@JazzCore

Description

@JazzCore

When acquiring any non-live Windows container (HDD, VM image) from Linux with case-sensitive filesystem output tar/directory contains duplicate directories with mixed case:

For example, running acquire windows-vm.qcow2 on Linux with btrfs gives following directories (truncated for readability):

$ tree
.
└── C:
    ├── $Recycle.bin
    ├── $Recycle.Bin
    ├── windows
    │   ├── appcompat
    │   ├── system32
    │   │   ├── config
    │   │   ├── drivers
    │   │   ├── sru
    │   │   ├── tasks
    │   │   ├── wbem
    │   │   └── winevt
    │   └── tasks
    └── Windows
        └── System32
            └── WDI

Notice duplicated $Recycle.Bin, Windows, System32 directories with different case.
I managed to somewhat fix it with replacing all sysvol/windows/ and /sysvol/windows/system32 strings in acquire.py with proper case, but this method also requires similar changes in other dissect libraries, since acquire calls them to get collection paths. Surely there are a better fix for this than specifying correct case in collection paths, e.g. using proper path from filesystem for output path

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions