diff --git a/acquire/acquire.py b/acquire/acquire.py index 8ff431ae..9bb64949 100644 --- a/acquire/acquire.py +++ b/acquire/acquire.py @@ -1217,9 +1217,13 @@ class RemoteAccess(Module): ("glob", "sysvol/Program Files/TeamViewer/*.log"), ("glob", "sysvol/Program Files (x86)/TeamViewer/*.log"), ("glob", "AppData/Roaming/TeamViewer/*.log", from_user_home), - # anydesk + # anydesk - Windows ("dir", "sysvol/ProgramData/AnyDesk"), ("glob", "AppData/Roaming/AnyDesk/*.trace", from_user_home), + ("glob", "AppData/Roaming/AnyDesk/*/*.trace", from_user_home), + # anydesk - Mac + Linux + ("glob", ".anydesk*/*.trace", from_user_home), + ("file", "/var/log/anydesk.trace"), # zoho ("dir", "sysvol/ProgramData/ZohoMeeting/log"), ("dir", "AppData/Local/ZohoMeeting/log", from_user_home),