diff --git a/dissect/target/plugins/os/windows/_os.py b/dissect/target/plugins/os/windows/_os.py index b8d94f915..b0bb71361 100644 --- a/dissect/target/plugins/os/windows/_os.py +++ b/dissect/target/plugins/os/windows/_os.py @@ -1,5 +1,6 @@ from __future__ import annotations +import operator import struct from typing import Any, Iterator, Optional @@ -77,6 +78,14 @@ def add_mounts(self) -> None: self.target.log.warning("Failed to map drive letters") self.target.log.debug("", exc_info=e) + # Fallback mount the sysvol to C: if we didn't manage to mount it to any other drive letter + if operator.countOf(self.target.fs.mounts.values(), self.target.fs.mounts["sysvol"]) == 1: + if "c:" not in self.target.fs.mounts: + self.target.log.debug("Unable to determine drive letter of sysvol, falling back to C:") + self.target.fs.mount("c:", self.target.fs.mounts["sysvol"]) + else: + self.target.log.warning("Unknown drive letter for sysvol") + @export(property=True) def hostname(self) -> Optional[str]: key = "HKLM\\SYSTEM\\ControlSet001\\Control\\Computername\\Computername"