Skip to content

New collection and de-duplication logic#161

Merged
pyrco merged 1 commit intomainfrom
feature/dis-1222_dedup-sysvol-collection
May 6, 2024
Merged

New collection and de-duplication logic#161
pyrco merged 1 commit intomainfrom
feature/dis-1222_dedup-sysvol-collection

Conversation

@pyrco
Copy link
Contributor

@pyrco pyrco commented Mar 26, 2024

When paths contain intermediate symlinks, these intermediate symlinks are collected instead of collecting the unresolved path as is. De-duplication between sysvol and it's equivalent drive letter path is done properly.
Collecting of special files (e.g. MFT, Recyclebin etc.) is properly abstracted.

(DIS-1222)

@pyrco pyrco requested a review from Schamper March 26, 2024 07:52
@codecov-commenter
Copy link

codecov-commenter commented Mar 26, 2024

Codecov Report

Attention: Patch coverage is 63.43284% with 98 lines in your changes are missing coverage. Please review.

Project coverage is 43.02%. Comparing base (36ab928) to head (3e2526c).

Files Patch % Lines
acquire/acquire.py 14.49% 59 Missing ⚠️
acquire/collector.py 79.03% 39 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #161      +/-   ##
==========================================
+ Coverage   41.72%   43.02%   +1.29%     
==========================================
  Files          26       26              
  Lines        3276     3312      +36     
==========================================
+ Hits         1367     1425      +58     
+ Misses       1909     1887      -22     
Flag Coverage Δ
unittests 43.02% <63.43%> (+1.29%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@pyrco pyrco force-pushed the feature/dis-1222_dedup-sysvol-collection branch from 058e494 to 3a4f5d0 Compare March 26, 2024 08:00
Copy link
Member

@Schamper Schamper left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My output also sometimes has mixed drive letter capitalization, notably for the PowerShell history and Startup LNK files. Ideally we normalize that too.

@pyrco pyrco force-pushed the feature/dis-1222_dedup-sysvol-collection branch from 3a4f5d0 to a550d6f Compare April 8, 2024 13:27
@pyrco pyrco requested a review from Schamper April 8, 2024 14:34
@pyrco
Copy link
Contributor Author

pyrco commented Apr 10, 2024

My output also sometimes has mixed drive letter capitalization, notably for the PowerShell history and Startup LNK files. Ideally we normalize that too.

That is the same issue as generic path name uniformization. So see my comment about that.

@pyrco pyrco force-pushed the feature/dis-1222_dedup-sysvol-collection branch 2 times, most recently from 74998ba to e377333 Compare April 12, 2024 08:16
@pyrco pyrco force-pushed the feature/dis-1222_dedup-sysvol-collection branch from e377333 to d0b5a0c Compare May 3, 2024 11:19
When paths contain intermediate symlinks, these intermediate symlinks
are collected instead of collecting the unresolved path as is.
De-duplication between sysvol and it's equivalent drive letter path
is done properly.
Collecting of special files (e.g. MFT, Recyclebin etc.) is properly
abstracted.

(DIS-1222)
@pyrco pyrco force-pushed the feature/dis-1222_dedup-sysvol-collection branch from d0b5a0c to 3e2526c Compare May 3, 2024 13:53
@pyrco pyrco merged commit 8a3a0b5 into main May 6, 2024
@pyrco pyrco deleted the feature/dis-1222_dedup-sysvol-collection branch May 6, 2024 06:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants