acquire icon indicating copy to clipboard operation
acquire copied to clipboard

OSX module InstallHistory.plist file treated as a directory

Open Politie-SOC opened this issue 1 year ago • 1 comments

https://github.com/fox-it/acquire/blob/00533952ace6d432c230edc338a7f01b8e650b1f/acquire/acquire.py#L1410

This file is wrongly marked as a directory. It is, in fact, a regular file:

$ ls -lah
total 40
drwxrwxr-x   4 root        admin   128B Mar 18 21:58 .
drwxr-xr-x  72 root        wheel   2.3K Mar 15 11:21 ..
-rw-rw-r--   1 root        admin    20K Mar 18 21:58 InstallHistory.plist

Politie-SOC avatar Mar 19 '24 09:03 Politie-SOC

Hi, thanks for reporting this. This is indeed confusing wording, functionally it doesn't matter as file, dir and symlink artifacts are all treated as a path artifact. At some point we will replace all the mentions of file, dir and symlink by path and this confusion will go away.

pyrco avatar Oct 07 '24 12:10 pyrco