Windows.KapeFiles.Extract

name: Windows.KapeFiles.Extract
description: |
  Extracts files collected by the `Windows.KapeFiles.Targets` or
  `Windows.Triage.Targets` artifacts, and restores the original
  timestamps on the extracted files.

  These artifacts collect files from the endpoint into a zip file. Zip
  files cannot generally preserve timestamps since they only have a
  single timestamp concept. Velociraptor will only record the modified
  time in the zip file header itself but all the times are present in
  the internal metadata file: `Windows.KapeFiles.Targets/All File
  Metadata.json`

  Sometimes, users wish to extract the contents of a collection to a
  directory, and run an external tool over the data. Some such
  external tools assume the file timestamps (e.g. prefetch files) are
  meaningful. In this case we need to preserve the timestamps.

  You can use this artifact to extract the content of a collection
  while preserving the timestamps. The artifact will read the metadata
  file, unpack the contents of the container and set the timestamps on
  the resulting file.

  NOTE: Windows allows 3 timestamps to be set (MAC time except for
  Btime), while Linux only allows 2 timestamps (Modified and
  Accessed).

  ### Example - command line use

  ```
  velociraptor artifacts collect Windows.KapeFiles.Extract --args ContainerPath=Collection-DESKTOP-2OR51GL-2021-07-16_06_56_50_-0700_PDT.zip --args OutputDirectory=/tmp/MyOutput/
  ```

type: SERVER

parameters:
  - name: OutputDirectory
    description: Directory to write on (must be set).
  - name: ContainerPath
    description: Path to container (zip file) to unpack.

sources:
  - query: |
      LET MetadataFile = ("results", "Windows.KapeFiles.Targets/All File Metadata.json")
      LET UploadsFile = "uploads.json"

      // Path to the root of the container
      LET RootPathSpec = pathspec(DelegateAccessor="auto",
                                  path_type="zip",
                                  DelegatePath=ContainerPath)

      // The pathspec for where to store the file
      LET OutputPathSpec = pathspec()

      // Memoize the metadata stored in the container file so we can
      // quickly extract the file times.
      LET AllFileMetadata <= memoize(
          key="SourceFile",
          query={
            SELECT *
            FROM parse_jsonl(accessor="collector",
                             filename=RootPathSpec + MetadataFile)
          })

      LET ALLUploads = SELECT *, ( RootPathSpec + _Components ).Path AS FileUpload,
                              OutputPathSpec + _Components[2:] AS Dest,
                              get(item=AllFileMetadata,
                                  field=vfs_path) AS Metadata
        FROM parse_jsonl(accessor="collector",
                         filename=RootPathSpec + UploadsFile)
        WHERE Type != "idx"

      SELECT *, upload_directory(
          accessor="collector",
          output=OutputDirectory,
          mtime=Metadata.Modified,
          atime=Metadata.LastAccessed,
          ctime=Metadata.Created,
          name=Dest,
          file=RootPathSpec + _Components) AS UploadedFile
      FROM ALLUploads