Comments (2)
Hello,
There is a mistake in your configuration but also a bug.
The configuration must never specify '{UserProfile}' prepended with a path.
The '{UserProfile}' element should be replaced during execution with something like :
C:\Windows\system32\config\systemprofile\Downloads
C:\Windows\ServiceProfiles\LocalService\Downloads
C:\Windows\ServiceProfiles\NetworkService\Downloads
C:\Users\Foo\Downloads
C:\Users\Bar\Downloads
...
However it will not work before the 10.0.24 because there is a bug on the path '\Downloads' appended to '{UserProfile}'. Meanwhile you can still use <location>{UserProfiles}</location>
and restrict match with ntfs_find's path_match
.
Thank you
Bonjour,
Il y a une erreur dans votre configuration mais aussi un bug.
La configuration ne devrait jamais spécifier '{UserProfiles}' précédé d'un chemin.
L'élément '{UserProfile}\Downloads' devrait être remplacé à l'exécution avec par exemple :
C:\Windows\system32\config\systemprofile\Downloads
C:\Windows\ServiceProfiles\LocalService\Downloads
C:\Windows\ServiceProfiles\NetworkService\Downloads
C:\Users\Foo\Downloads
C:\Users\Bar\Downloads
...
Cependant cela ne fonctionnera pas avant la 10.0.24 car il y a un bug sur la gestion d'un chemin '\Downloads' qui suit '{UserProfile}'. En attendant vous pourriez utiliser <location>{UserProfiles}</location>
et limiter la recherche avec path_match
de ntfs_find.
Merci
from dfir-orc.
Also beware that known folders path like %USERPROFILE%\Downloads
can be customized out of %USERPROFILE%
tree.
Gardez à l'esprit que les chemins de type known folders comme %USERPROFILE\Downloads
peuvent être configuré vers un chemin en dehors de l'arborescence de %USERPROFILE%
.
from dfir-orc.
Related Issues (20)
- Feature request - allow authentication without a clear text password in upload balise from the local config file HOT 3
- Zircolite Integration HOT 3
- 7zip compressor issue with v10.0.22 HOT 2
- [WolfLauncher] directory output not merged into the final archive HOT 4
- Feature request: Keep folder structure of the files and folders that are collected HOT 2
- Launch embed Script.ps1 alone or binary with configuration file HOT 1
- Password related error in local configuration file HOT 7
- DFIR_Orc Cannot compile using VS2022 HOT 5
- Add capabillity to launch the right autorunsc depending on architecture
- Can't compile because of cli11[core]:x86-windows-static HOT 2
- Multiples issues on compilation with VS2019 and VS2022 HOT 3
- Error during compilation : can't install CLI11 package HOT 4
- Launch embedded KAPE with Targets doesn't work and produces errors HOT 7
- How long does NTFS keep transaction logs? HOT 2
- Need help on building the package HOT 1
- Compilation error x86 and x64 HOT 1
- Problem getting DFIR-Orc.exe HOT 1
- Terminated with large tempstream file HOT 2
- CMAKE_TOOLCHAIN_FILE AUTODETECT ISSUE HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dfir-orc.