Add option to recursively find folders

[chadtilbury]

Files can be recursively searched for, but not folders. While many artifacts are in fixed locations, there are a subset which are not. Good examples are user folders for common cloud storage applications. OneDrive, Dropbox, Box, etc. preferences can be set to store files in non-default locations (i.e. %USERPROFILE%\CloudFiles\Dropbox instead of the default %USERPROFILE%\Dropbox). It would be advantageous to be able to set a starting point (%USERPROFILE% in this example) and a folder name (wild-card enabled) to recursively search for from that point.

[EricZimmerman]

While interesting this does little when the folder is completely renamed

Why not target a file that is always in the folder and look for that, like some metadata about Dropbox or something?

I'll certainly see what I can do for folders tho

[pleaseemail]

This feature would be very useful for investigations wherein a subject may keep various files under unique folder name(s) but the folders may be present in multiple (unknown) places on the volume.

[mdawsonuk]

This would be extremely useful for portable applications which can be installed anywhere but have to have a specific folder structure eg Tor Browser needs a \TorBrowser\Data\Tor structure for its data files.

[EricZimmerman]

Then just search for the executable and back into it that way, no?

…

On Sat, Oct 3, 2020, 12:47 PM Matt ***@***.***> wrote: This would be extremely useful for portable applications which can be installed anywhere but have to have a specific folder structure eg Tor Browser needs a \TorBrowser\Data\Tor structure for its data files. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#125 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABARKJTEOJODBMPNLTJX35TSI5IQPANCNFSM4IPHUUJQ> .

[EricZimmerman]

i started laying the groundwork for this

FINDING the directory is easy, but there are several other things that need updated to copy out dirs vs files.

#progress