OrcCommand: FastFind: add support for 'log' option

DFIR-ORC · Feb 11, 2021 · 9d43a50 · 9d43a50
1 parent fc89ff1
commit 9d43a50
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 4 deletions.
diff --git a/src/OrcCommand/ConfigFile_FastFind.cpp b/src/OrcCommand/ConfigFile_FastFind.cpp
@@ -12,6 +12,8 @@
 
 #include "ConfigFile_FastFind.h"
 
+#include "Log/UtilitiesLoggerConfiguration.h"
+
 using namespace Orc::Config::Common;
 
 HRESULT Orc::Config::FastFind::object(ConfigItem& parent, DWORD dwIndex)
@@ -113,6 +115,8 @@ HRESULT Orc::Config::FastFind::root(ConfigItem& item)
         return hr;
     if (FAILED(hr = item.AddChild(logging, FASTFIND_LOGGING)))
         return hr;
+    if (FAILED(hr = item.AddChild(Orc::Command::UtilitiesLoggerConfiguration::Register, FASTFIND_LOG)))
+        return hr;
     if (FAILED(hr = item.AddChild(filesystem, FASTFIND_FILESYSTEM)))
         return hr;
     if (FAILED(hr = item.AddChild(registry, FASTFIND_REGISTRY)))

diff --git a/src/OrcCommand/ConfigFile_FastFind.h b/src/OrcCommand/ConfigFile_FastFind.h
@@ -42,10 +42,11 @@ constexpr auto FASTFIND_REGISTRY_HIVE = 2L;
 
 constexpr auto FASTFIND_VERSION = 0L;
 constexpr auto FASTFIND_LOGGING = 1L;
-constexpr auto FASTFIND_FILESYSTEM = 2L;
-constexpr auto FASTFIND_REGISTRY = 3L;
-constexpr auto FASTFIND_SERVICE = 4L;
-constexpr auto FASTFIND_OBJECT = 5L;
+constexpr auto FASTFIND_LOG = 2L;
+constexpr auto FASTFIND_FILESYSTEM = 3L;
+constexpr auto FASTFIND_REGISTRY = 4L;
+constexpr auto FASTFIND_SERVICE = 5L;
+constexpr auto FASTFIND_OBJECT = 6L;
 
 constexpr auto FASTFIND_OUTPUT_FILESYSTEM = 6L;
 constexpr auto FASTFIND_OUTPUT_REGISTRY = 7L;

diff --git a/src/OrcCommand/FastFind_Config.cpp b/src/OrcCommand/FastFind_Config.cpp
@@ -73,6 +73,17 @@ HRESULT Main::GetConfigurationFromConfig(const ConfigItem& configitem)
     {
         return hr;
     }
+
+    if (configitem[FASTFIND_LOGGING])
+    {
+        Log::Warn(L"The '<logging> configuration element is deprecated, please use '<log>' instead");
+    }
+
+    if (configitem[FASTFIND_LOG])
+    {
+        UtilitiesLoggerConfiguration::Parse(configitem[FASTFIND_LOG], m_utilitiesConfig.log);
+    }
+
     if (FAILED(
             hr = config.outObject.Configure(
                 static_cast<OutputSpec::Kind>(OutputSpec::Kind::TableFile), configitem[FASTFIND_OUTPUT_OBJECT])))
@@ -225,6 +236,8 @@ HRESULT Main::GetConfigurationFromArgcArgv(int argc, LPCWSTR argv[])
 {
     HRESULT hr = E_FAIL;
 
+    UtilitiesLoggerConfiguration::Parse(argc, argv, m_utilitiesConfig.log);
+
     for (int i = 0; i < argc; i++)
     {
         switch (argv[i][0])
@@ -316,6 +329,8 @@ HRESULT Main::CheckConfiguration()
 {
     HRESULT hr = E_FAIL;
 
+    UtilitiesLoggerConfiguration::Apply(m_logging, m_utilitiesConfig.log);
+
     bool bSomeThingToParse = false;
 
     config.FileSystem.Locations.Consolidate(config.bAddShadows, FSVBR::FSType::NTFS);