acquire icon indicating copy to clipboard operation
acquire copied to clipboard

Inconsistent output paths when acquiring Windows container from Linux

Open JazzCore opened this issue 1 year ago • 1 comments

When acquiring any non-live Windows container (HDD, VM image) from Linux with case-sensitive filesystem output tar/directory contains duplicate directories with mixed case:

For example, running acquire windows-vm.qcow2 on Linux with btrfs gives following directories (truncated for readability):

$ tree
.
└── C:
    ├── $Recycle.bin
    ├── $Recycle.Bin
    ├── windows
    │   ├── appcompat
    │   ├── system32
    │   │   ├── config
    │   │   ├── drivers
    │   │   ├── sru
    │   │   ├── tasks
    │   │   ├── wbem
    │   │   └── winevt
    │   └── tasks
    └── Windows
        └── System32
            └── WDI

Notice duplicated $Recycle.Bin, Windows, System32 directories with different case. I managed to somewhat fix it with replacing all sysvol/windows/ and /sysvol/windows/system32 strings in acquire.py with proper case, but this method also requires similar changes in other dissect libraries, since acquire calls them to get collection paths. Surely there are a better fix for this than specifying correct case in collection paths, e.g. using proper path from filesystem for output path

JazzCore avatar May 30 '24 12:05 JazzCore

We appreciate your awareness of the duplication issue with Dissect artefacts. The issue arises from utilizing a diverse range of sources to curate artefacts. While our tools do address duplicates for certain functions, they may persist in raw tar extracts due to the varied nature of source methodologies.

Currently, the best solution is to implement post-extraction post-processing, potentially by a script or third-party Dissect tool. However, we would like to inform you that we do not plan to add such features to our core software. The tar archive should be regarded as a transitional data repository, intended for subsequent processing rather than direct manual extraction.

cecinestpasunepipe avatar Jun 19 '24 10:06 cecinestpasunepipe