Skip to content

Add NTFS and RemoteAccess paths #259

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Schamper merged 3 commits into from
Aug 14, 2025
Merged

Add NTFS and RemoteAccess paths #259

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
baff79a
Add NTFS and RemoteAccess paths
qmadev Aug 8, 2025
348199c
Merge branch 'main' into feature/acquire_paths
Schamper Aug 13, 2025
8675924
Change artifact types
qmadev Aug 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 39 additions & 14 deletions acquire/acquire.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -359,8 +359,15 @@ class NTFS(Module):
def _run(cls, target: Target, cli_args: argparse.Namespace, collector: Collector) -> None:
for fs, main_mountpoint, name, mountpoints in iter_ntfs_filesystems(target):
log.info("Acquiring from %s as %s (%s)", fs, name, mountpoints)
filenames = [
"$MFT",
"$Boot",
"$Secure:$SII",
"$Secure:$SDS",
"$LogFile",
]

for filename in ("$MFT", "$Boot", "$Secure:$SDS"):
for filename in filenames:
if main_mountpoint is not None:
path = fsutil.join(main_mountpoint, filename)
collector.collect_path(path)
Expand All @@ -372,6 +379,7 @@ def _run(cls, target: Target, cli_args: argparse.Namespace, collector: Collector
collector.collect_file_raw(filename, fs, name)

cls.collect_usnjrnl(collector, fs, name)
cls.collect_rmmetadata(collector, fs, name)

@classmethod
def collect_usnjrnl(cls, collector: Collector, fs: Filesystem, name: str) -> None:
Expand All @@ -389,12 +397,26 @@ def usnjrnl_accessor(journal: BinaryIO) -> tuple[BinaryIO, int]:

return (journal, size)

collector.collect_file_raw(
"$Extend/$Usnjrnl:$J",
fs,
name,
file_accessor=usnjrnl_accessor,
)
for filename in ("$Extend/$Usnjrnl:$J", "$Extend/$Usnjrnl:$Max"):
collector.collect_file_raw(
filename,
fs,
name,
file_accessor=usnjrnl_accessor,
)

@classmethod
def collect_rmmetadata(cls, collector: Collector, fs: Filesystem, name: str) -> None:
filenames = [
"$Extend/$RmMetadata/$TxfLog/$T",
"$Extend/$RmMetadata/$TxfLog/$Tops:$T",
]
for filename in filenames:
collector.collect_file_raw(
filename,
fs,
name,
)


@register_module("-r", "--registry")
Expand Down Expand Up @@ -1323,11 +1345,15 @@ def get_spec_additions(cls, target: Target, cli_args: argparse.Namespace) -> Ite
class RemoteAccess(Module):
DESC = "common remote access tools' log files"
SPEC = (
# teamviewer
# teamviewer - Windows
("glob", "sysvol/Program Files/TeamViewer/*.log"),
("path", "sysvol/Program Files/TeamViewer/Connections_incoming.txt"),
("glob", "sysvol/Program Files (x86)/TeamViewer/*.log"),
("glob", "/var/log/teamviewer*/*.log"),
("path", "sysvol/Program Files (x86)/TeamViewer/Connections_incoming.txt"),
("glob", "AppData/Roaming/TeamViewer/*.log", from_user_home),
("path", "AppData/Roaming/TeamViewer/Connections.txt", from_user_home),
# teamviewer - Mac + Linux
("glob", "/var/log/teamviewer*/*.log"),
("glob", "Library/Logs/TeamViewer/*.log", from_user_home),
# anydesk - Windows
("path", "sysvol/ProgramData/AnyDesk"),
Expand All @@ -1336,12 +1362,11 @@ class RemoteAccess(Module):
("glob", ".anydesk*/*", from_user_home),
("path", "/var/log/anydesk.trace"),
# RustDesk - Windows
("path", "sysvol/ProgramData/RustDesk"),
Copy link
Copy Markdown
Member

@Schamper Schamper Aug 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where'd this one go? Our parser for it suggests that server logs are stored here. @lhaagsma?

Copy link
Copy Markdown
Contributor Author

@qmadev qmadev Aug 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did a full install on 2 machines, used RustDesk to connect them. On both hosts, no C:\ProgramData\RustDesk. But just say the word and I'll add it back in.

Copy link
Copy Markdown
Contributor Author

@qmadev qmadev Aug 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any news on this?

Copy link
Copy Markdown
Contributor

@lhaagsma lhaagsma Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure based on what I added this path. Perhaps I added this path 'just to be sure' as I believe Anydesk does store data there and the two are very similar.

Copy link
Copy Markdown
Member

@Schamper Schamper Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If there's no evidence that RustDesk actually stores data there then I think it's fine to remove it.

("path", "AppData/Roaming/RustDesk/log/server/", from_user_home),
("path", "AppData/Roaming/RustDesk/log/", from_user_home),
# RustDesk - Mac + Linux
("path", ".local/share/logs/RustDesk/server/", from_user_home),
("path", "/var/log/RustDesk"),
("path", "Library/Logs/RustDesk/Server", from_user_home),
("path", ".local/share/logs/RustDesk/", from_user_home),
("path", "/var/log/RustDesk/"),
("path", "Library/Logs/RustDesk/", from_user_home),
# zoho
("path", "sysvol/ProgramData/ZohoMeeting/log"),
("path", "AppData/Local/ZohoMeeting/log", from_user_home),
Expand Down
Loading