Skip to content

Add NTFS and RemoteAccess paths#259

Merged
Schamper merged 3 commits intofox-it:mainfrom
qmadev:feature/acquire_paths
Aug 14, 2025
Merged

Add NTFS and RemoteAccess paths#259
Schamper merged 3 commits intofox-it:mainfrom
qmadev:feature/acquire_paths

Conversation

@qmadev
Copy link
Copy Markdown
Contributor

@qmadev qmadev commented Aug 8, 2025

closes #258
closes #155
closes #180

Initially just wanted to add RustDesk paths, but noticed some easy to fix issues so added those as well.

Looking at the RustDesk Github Page, I noticed that some files would not get collected with the current config. This PR should fix that.

("glob", ".anydesk*/*", from_user_home),
("path", "/var/log/anydesk.trace"),
# RustDesk - Windows
("path", "sysvol/ProgramData/RustDesk"),
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where'd this one go? Our parser for it suggests that server logs are stored here. @lhaagsma?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did a full install on 2 machines, used RustDesk to connect them. On both hosts, no C:\ProgramData\RustDesk. But just say the word and I'll add it back in.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any news on this?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure based on what I added this path. Perhaps I added this path 'just to be sure' as I believe Anydesk does store data there and the two are very similar.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If there's no evidence that RustDesk actually stores data there then I think it's fine to remove it.

@qmadev
Copy link
Copy Markdown
Contributor Author

qmadev commented Aug 13, 2025

Fixed the artifact types. Lmk if you want me to remove the RustDesk path from dissect.target.

@qmadev qmadev requested a review from Schamper August 13, 2025 21:42
@codecov
Copy link
Copy Markdown

codecov bot commented Aug 14, 2025

Codecov Report

❌ Patch coverage is 20.00000% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 44.89%. Comparing base (c243af8) to head (8675924).
⚠️ Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
acquire/acquire.py 20.00% 8 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #259      +/-   ##
==========================================
- Coverage   44.93%   44.89%   -0.05%     
==========================================
  Files          26       26              
  Lines        3527     3535       +8     
==========================================
+ Hits         1585     1587       +2     
- Misses       1942     1948       +6     
Flag Coverage Δ
unittests 44.89% <20.00%> (-0.05%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Schamper Schamper merged commit c403f87 into fox-it:main Aug 14, 2025
22 of 25 checks passed
@Schamper
Copy link
Copy Markdown
Member

Fixed the artifact types. Lmk if you want me to remove the RustDesk path from dissect.target.

Yeah that might be nice for consistency.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Collect TeamViewer connections logs Collect $Secure:$SII NTFS file Additional NTFS Artefact Collection

3 participants