Fallback mount sysvol to C: if not mounted to another drive letter (#671

)

dissect/target/plugins/os/windows/_os.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import operator
 import struct
 from typing import Any, Iterator, Optional
 
@@ -77,6 +78,14 @@ def add_mounts(self) -> None:
             self.target.log.warning("Failed to map drive letters")
             self.target.log.debug("", exc_info=e)
 
+        # Fallback mount the sysvol to C: if we didn't manage to mount it to any other drive letter
+        if operator.countOf(self.target.fs.mounts.values(), self.target.fs.mounts["sysvol"]) == 1:
+            if "c:" not in self.target.fs.mounts:
+                self.target.log.debug("Unable to determine drive letter of sysvol, falling back to C:")
+                self.target.fs.mount("c:", self.target.fs.mounts["sysvol"])
+            else:
+                self.target.log.warning("Unknown drive letter for sysvol")
+
     @export(property=True)
     def hostname(self) -> Optional[str]:
         key = "HKLM\\SYSTEM\\ControlSet001\\Control\\Computername\\Computername"