From 5028a751fec2aad76ef96fc7d352fa21a2058877 Mon Sep 17 00:00:00 2001 From: Matthijs Vos Date: Tue, 10 Feb 2026 22:36:24 +0100 Subject: [PATCH 1/2] Add Teamviewer MRU files --- acquire/acquire.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/acquire/acquire.py b/acquire/acquire.py index c7f88b0d..bd44b558 100644 --- a/acquire/acquire.py +++ b/acquire/acquire.py @@ -1378,12 +1378,12 @@ class RemoteAccess(Module): DESC = "common remote access tools' log files" SPEC = ( # teamviewer - Windows - ("glob", "sysvol/Program Files/TeamViewer/*.log"), - ("path", "sysvol/Program Files/TeamViewer/Connections_incoming.txt"), - ("glob", "sysvol/Program Files (x86)/TeamViewer/*.log"), - ("path", "sysvol/Program Files (x86)/TeamViewer/Connections_incoming.txt"), + ("glob", "sysvol/Program Files*/TeamViewer/*.log"), + ("path", "sysvol/Program Files*/TeamViewer/Connections_incoming.txt"), ("glob", "AppData/Roaming/TeamViewer/*.log", from_user_home), ("path", "AppData/Roaming/TeamViewer/Connections.txt", from_user_home), + ("path", "AppData/Roaming/TeamViewer/MRU/RemoteSupport", from_user_home), + ("path", "AppData/Roaming/TeamViewer/MRU/Meeting", from_user_home), # teamviewer - Mac + Linux ("glob", "/var/log/teamviewer*/*.log"), ("glob", "Library/Logs/TeamViewer/*.log", from_user_home), From 24d2810a674fe49f029ec583d6698a79336c4678 Mon Sep 17 00:00:00 2001 From: Matthijs Vos Date: Wed, 11 Feb 2026 13:56:06 +0100 Subject: [PATCH 2/2] Fix collection, path should be glob --- acquire/acquire.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/acquire/acquire.py b/acquire/acquire.py index 663fb2e5..ed21f034 100644 --- a/acquire/acquire.py +++ b/acquire/acquire.py @@ -1365,7 +1365,7 @@ class RemoteAccess(Module): SPEC = ( # teamviewer - Windows ("glob", "sysvol/Program Files*/TeamViewer/*.log"), - ("path", "sysvol/Program Files*/TeamViewer/Connections_incoming.txt"), + ("glob", "sysvol/Program Files*/TeamViewer/Connections_incoming.txt"), ("glob", "AppData/Roaming/TeamViewer/*.log", from_user_home), ("path", "AppData/Roaming/TeamViewer/Connections.txt", from_user_home), ("path", "AppData/Roaming/TeamViewer/MRU/RemoteSupport", from_user_home),