Skip to content

Support WSL for live system inspection #35

@abelcheung

Description

@abelcheung

It should be possible to support running under WSL (v2 at least) for --live option.

  • Run whoami.exe to retrieve current user SID
whoami.exe /user /fo csv
"User Name","SID"
"machine\user","S-1-5-21-..."
  • Get mounted drives from /proc/mounts with fstype drvfs
  • Build the possible recycle bin folders from above data

For detection of WSL environment, probably this comment would be one of the most comprehensive.

Metadata

Metadata

Assignees

Labels

Projects

Status

Done

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions