Best way to collect $MFT, $UsnJrnl and $LogFile

[antmar904]

Hi.
What is the best way to collect the above mentioned files from a file server that has multiple volumes? When I look at the target file called "FileSystem" located in Targets\Compound\FileSystem.tkape it looks like these files are only collected from volume C:

What would be a easy way to search for all volumes present when running KAPE and collect the mentioned files above?

[EricZimmerman]

why do you say that? just because the target references C:$MFT does not mean you cannot collect ANY volume. This is what --tsource is for.

if you do

--tsource D

then KAPE will collect D:$MFT

KAPE does all the work of updating things from the target definition based on what you pass in via --tsource.

we always reference C:\ as the start for all files to keep it simple and consistent.

if you wanted ALL file systems you would need to write a simple powershell script or similar to:

1. locate all logical drive letters you want to search
2. call kape on each one, updating the value for --tsource

thats it.

[antmar904]

ah got it. sorry it's monday. I usually only collect data on workstations and it's my first need to collect data on a file server. ill give it a go!

[antmar904]

to make things easier can I just create a new tkape file and specify all drive letters that are possible and if found kape will copy them?
exp:

-
    Name: $MFT
    Category: FileSystem
    Path: C:\
    FileMask: $MFT
    AlwaysAddToQueue: true
-
    Name: $MFT
    Category: FileSystem
    Path: D:\
    FileMask: $MFT
    AlwaysAddToQueue: true
    
-
    Name: $MFT
    Category: FileSystem
    Path: E:\
    FileMask: $MFT
    AlwaysAddToQueue: true
    
-
    Name: $MFT
    Category: FileSystem
    Path: F:\
    FileMask: $MFT
    AlwaysAddToQueue: true
    
-
    Name: $MFT
    Category: FileSystem
    Path: G:\
    FileMask: $MFT
    AlwaysAddToQueue: true

[EricZimmerman]

nope. that wont work.

regardless of what you put there, kape updates each path with what you send in via --tsource

[antmar904]

got it, ty!