-
Notifications
You must be signed in to change notification settings - Fork 480
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Zip accessor LZMA support #3608
Comments
It is not a standard compression method. We are unlikely to support it. |
You might be able to unzip the file to a temp directory and then post process in Velociraptor - this might also solve your case insensitive issue because you can use the file_nocase accessor |
I filed a pull request to dissect project see fox-it/acquire#182, which triggered fox-it/acquire#185. So acquire is supporting deflate in the near future there, solving my issue here. We could of course also extract the collects first (which we can use as a shortcut for now of course), but it can be unefficient and could consume too much resources in some cases. |
Maybe this is capable of handling LZMA zip files ? If so we can probably wrap it in a VQL accessor as an alternative |
Related to my issue about case sensitivity for zip accessors, I noticed that the zip accessor does not support LZMA compression (for Dissect acquire collects with lzma compression)
Don't know if this is something worth implementing, but thought I'd report it nonetheless
The text was updated successfully, but these errors were encountered: