diff --git a/acquire/collector.py b/acquire/collector.py index be9f2d0c..62305ee0 100644 --- a/acquire/collector.py +++ b/acquire/collector.py @@ -1,4 +1,5 @@ from __future__ import annotations +from contextlib import contextmanager import dataclasses import errno @@ -9,7 +10,7 @@ from dataclasses import dataclass from itertools import groupby from pathlib import Path -from typing import TYPE_CHECKING, Any, Iterable, Optional, Sequence, Type, Union +from typing import TYPE_CHECKING, Any, Iterable, Optional, Sequence, Type, Union, Callable from dissect.target import Target from dissect.target.exceptions import ( @@ -184,6 +185,7 @@ def __init__(self, target: Target, output: Output, base: str = "fs", skip_list: self.report = CollectionReport() self.bound_module_name = None + self.filter: Callable[[fsutil.TargetPath], bool] = None self.output.init(self.target) @@ -193,6 +195,14 @@ def __enter__(self) -> Collector: def __exit__(self, *args, **kwargs) -> None: self.close() + @contextmanager + def file_filter(self, filter: Callable[[fsutil.TargetPath], bool]) -> Collector: + try: + self.filter = filter + yield self + finally: + self.filter = None + def bind(self, module: Type) -> None: self.bound_module_name = module.__name__ @@ -263,6 +273,10 @@ def collect_file( if not isinstance(path, fsutil.TargetPath): path = self.target.fs.path(path) + if self.filter and self.filter(path) is False: + log.info("- Collecting file %s: Skipped (filtered out)", path) + return + if self.report.was_path_seen(path): log.info("- Collecting file %s: Skipped (DEDUP)", path) return