Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Windows.KapeFiles.Targets Does Not Collect $Boot #2892

Closed
Zawadidone opened this issue Aug 15, 2023 · 1 comment
Closed

Windows.KapeFiles.Targets Does Not Collect $Boot #2892

Zawadidone opened this issue Aug 15, 2023 · 1 comment

Comments

@Zawadidone
Copy link
Contributor

Version tested: https://github.com/Velocidex/velociraptor/releases/tag/v0.7.0

It appears the Windows.KapeFiles.Targets artifact does not completely collect the $Boot file.

When running Windows.KapeFiles.Targets with an Offline Velociraptor Collector, the file size is 8192 but the uploaded size is 0.

# uploads.json
{"Timestamp":"2023-08-14T18:59:40.2460185Z","started":"2023-08-14 18:59:40.2460185 +0000 UTC","vfs_path":"\\\\.\\C:\\$Boot","_Components":["uploads","ntfs","\\\\.\\C:","$Boot"],"file_size":8192,"uploaded_size":0,"Type":""}

ls -al */uploads/*/*/\$Boot 

-rw-r--r-- 1 [...] staff 0 Mar 19  2019 '[...]/uploads/ntfs/%5C%5C.%5CC%3A/$Boot'
-rw-r--r-- 1 [...] staff 0 Mar 19  2019 '[...]/uploads/ntfs/%5C%5C.%5CC%3A/$Boot'
-rw-r--r-- 1 [...] staff 0 Mar 19  2019 '[...]/uploads/ntfs_vss/%5C%5C.%5CC%3A/$Boot'
-rw-r--r-- 1 [...] staff 0 Mar 19  2019 '[...]/uploads/ntfs_vss/%5C%5C.%5CC%3A/$Boot'

Reference

#2141

@scudette
Copy link
Contributor

Fixed by #2893

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants