acquire icon indicating copy to clipboard operation
acquire copied to clipboard

Acquire output does not contain a clear ending message

Open DissectBot opened this issue 1 year ago • 0 comments

Acquire can give confusing output, that does not make it obvious whether it exited cleanly or not. Even after a summary it sometimes still provides confusing output. This makes it unclear whether the acquisition process has ended due to a bug, or whether it ended the happy flow.

I strongly recommend ending cleanly with something like repeating e.g. the command line arguments like is done at the start. Then end with a clear message. For example:

[2023-11-02 16:46:26,193] [INFO ] Finishing acquisition [2023-11-02 16:46:26,367] [INFO ] Arguments: --children -o /vmfs/volumes/NFS_storetemp/server [2023-11-02 16:46:26,367] [INFO ] Default Arguments: --compress --ntds --active-directory --profile full [2023-11-02 16:46:26,573] [INFO ] Exiting with status code 0 (SUCCESS)

Note that this can also be confusing for individual child acquisitions with --children. The individual log files can also contain unclear beginning and ending log lines.

This should be a fairly simply fix with relatively high value. It can really help troubleshooting.

DissectBot avatar Mar 14 '24 16:03 DissectBot