From c35cb727ca71226d7d4253a111fd133f934b9b4e Mon Sep 17 00:00:00 2001 From: Lennart Haagsma <6630974+lhaagsma@users.noreply.github.com> Date: Thu, 1 May 2025 16:31:06 +0200 Subject: [PATCH 1/3] Adds --list-children arg --- acquire/acquire.py | 6 ++++++ acquire/utils.py | 8 +++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/acquire/acquire.py b/acquire/acquire.py index c830adb1..0ab0b7e4 100644 --- a/acquire/acquire.py +++ b/acquire/acquire.py @@ -2251,6 +2251,12 @@ def main() -> None: target_name = target.name log.info("Loading target %s", target_name) log.info(target) + # Check if we are just listing children and not collecting + if args.list_children: + log.info(f"Listing children on Target: %s", target.name) + for index, child in enumerate(target.list_children()): + log.info(f"- Found child #%s: type=%s, path=%s", index, child.type, child.path) + exit_success(args.config.get("arguments")) if target.os == "esxi" and target.name == "local": # Loader found that we are running on an esxi host # Perform operations to "enhance" memory diff --git a/acquire/utils.py b/acquire/utils.py index 72f7818f..83e75f9a 100644 --- a/acquire/utils.py +++ b/acquire/utils.py @@ -130,7 +130,13 @@ def create_argument_parser(profiles: dict, volatile: dict, modules: dict) -> arg parser.add_argument("--disable-report", action="store_true", help="disable acquisition report file") - parser.add_argument("--child", help="only collect specific child") + parser.add_argument( + "--list-children", + action=argparse.BooleanOptionalAction, + help="list all children by index and path - does not collect anything", + ) + + parser.add_argument("--child", help="only collect specific child based on index or path, see --list-children") parser.add_argument( "--children", action=argparse.BooleanOptionalAction, From f4e1727e96f1907cc57453c9f22996f95bf92868 Mon Sep 17 00:00:00 2001 From: Lennart haagsma <6630974+lhaagsma@users.noreply.github.com> Date: Mon, 25 Aug 2025 14:09:00 +0200 Subject: [PATCH 2/3] Make use target tools utils. --- acquire/acquire.py | 6 ------ acquire/utils.py | 13 ++++++++++--- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/acquire/acquire.py b/acquire/acquire.py index a9565c4d..38389c31 100644 --- a/acquire/acquire.py +++ b/acquire/acquire.py @@ -2419,12 +2419,6 @@ def main() -> None: target_name = target.name log.info("Loading target %s", target_name) log.info(target) - # Check if we are just listing children and not collecting - if args.list_children: - log.info(f"Listing children on Target: %s", target.name) - for index, child in enumerate(target.list_children()): - log.info(f"- Found child #%s: type=%s, path=%s", index, child.type, child.path) - exit_success(args.config.get("arguments")) if target.os == "esxi" and target.name == "local": # Loader found that we are running on an esxi host # Perform operations to "enhance" memory diff --git a/acquire/utils.py b/acquire/utils.py index 61ce5013..2f5d5ac3 100644 --- a/acquire/utils.py +++ b/acquire/utils.py @@ -15,6 +15,7 @@ from typing import TYPE_CHECKING, Any from dissect.target.helpers import keychain +from dissect.target.tools.utils import _OverrideRequiredAction, list_children from acquire.outputs import ( COMPRESSION_METHODS, @@ -58,6 +59,8 @@ def _create_profile_information(profiles: dict) -> str: return desc + + def create_argument_parser(profiles: dict, volatile: dict, modules: dict) -> argparse.ArgumentParser: module_profiles = "Module:\n" + textwrap.indent(_create_profile_information(profiles), " ") volatile_profiles = "Volatile:\n" + textwrap.indent(_create_profile_information(volatile), " ") @@ -140,10 +143,9 @@ def create_argument_parser(profiles: dict, volatile: dict, modules: dict) -> arg parser.add_argument("--disable-report", action="store_true", help="disable acquisition report file") parser.add_argument( - "--list-children", - action=argparse.BooleanOptionalAction, - help="list all children by index and path - does not collect anything", + "--list-children", action=_OverrideRequiredAction, help="list all children indices and paths, then exit" ) + parser.add_argument("--recursive", action="store_true", help="make --list-children behave recursively") parser.add_argument("--child", help="only collect specific child based on index or path, see --list-children") parser.add_argument( @@ -220,6 +222,11 @@ def parse_acquire_args( args, rest = parser.parse_known_args() _merge_args_and_config(parser, args, config) + if args.list_children: + # List found children on targets and exit + list_children(args) + parser.exit(0) + return args, rest From cfc12eb83a0e4cb19fb7551a247a5d87c701175d Mon Sep 17 00:00:00 2001 From: Lennart Haagsma <6630974+lhaagsma@users.noreply.github.com> Date: Mon, 13 Oct 2025 11:19:39 +0200 Subject: [PATCH 3/3] fix linting --- acquire/utils.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/acquire/utils.py b/acquire/utils.py index 2f5d5ac3..025d6eac 100644 --- a/acquire/utils.py +++ b/acquire/utils.py @@ -59,8 +59,6 @@ def _create_profile_information(profiles: dict) -> str: return desc - - def create_argument_parser(profiles: dict, volatile: dict, modules: dict) -> argparse.ArgumentParser: module_profiles = "Module:\n" + textwrap.indent(_create_profile_information(profiles), " ") volatile_profiles = "Volatile:\n" + textwrap.indent(_create_profile_information(volatile), " ")