You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When acquiring any non-live Windows container (HDD, VM image) from Linux with case-sensitive filesystem output tar/directory contains duplicate directories with mixed case:
For example, running acquire windows-vm.qcow2 on Linux with btrfs gives following directories (truncated for readability):
Notice duplicated $Recycle.Bin, Windows, System32 directories with different case.
I managed to somewhat fix it with replacing all sysvol/windows/ and /sysvol/windows/system32 strings in acquire.py with proper case, but this method also requires similar changes in other dissect libraries, since acquire calls them to get collection paths. Surely there are a better fix for this than specifying correct case in collection paths, e.g. using proper path from filesystem for output path
The text was updated successfully, but these errors were encountered:
We appreciate your awareness of the duplication issue with Dissect artefacts. The issue arises from utilizing a diverse range of sources to curate artefacts. While our tools do address duplicates for certain functions, they may persist in raw tar extracts due to the varied nature of source methodologies.
Currently, the best solution is to implement post-extraction post-processing, potentially by a script or third-party Dissect tool. However, we would like to inform you that we do not plan to add such features to our core software. The tar archive should be regarded as a transitional data repository, intended for subsequent processing rather than direct manual extraction.
When acquiring any non-live Windows container (HDD, VM image) from Linux with case-sensitive filesystem output tar/directory contains duplicate directories with mixed case:
For example, running
acquire windows-vm.qcow2
on Linux with btrfs gives following directories (truncated for readability):Notice duplicated
$Recycle.Bin
,Windows
,System32
directories with different case.I managed to somewhat fix it with replacing all
sysvol/windows/
and/sysvol/windows/system32
strings inacquire.py
with proper case, but this method also requires similar changes in other dissect libraries, sinceacquire
calls them to get collection paths. Surely there are a better fix for this than specifying correct case in collection paths, e.g. using proper path from filesystem for output pathThe text was updated successfully, but these errors were encountered: