trustedsec/tscopy

Double copying of files

Closed this issue · 1 comments

If a file in Windows has a long file name, TSCopy will copy it out twice - once as the long name and once as the shortened name.

This can be replicated by copying out the c:\Windows\System32\winevt\Logs directory with the following command:

C:\Users\john\Desktop\tscopy-master\dist\TScopy_x64.exe -d C:\Windows\System32\winevt\Logs -o c:\temp\test1\tscopy

The resulting copied files are listed in at https://pastebin.com/pD90EqsU. Of note are entries like the following:

10/27/2020 02:28 PM 69,632 MI013A1.EVT
10/27/2020 02:28 PM 1,052,672 MI01EB
1.EVT
10/27/2020 02:28 PM 69,632 MI02C41.EVT
10/27/2020 02:28 PM 69,632 MI033E
1.EVT
10/27/2020 02:28 PM 69,632 MI03A71.EVT
10/27/2020 02:28 PM 69,632 MI1055
1.EVT
10/27/2020 02:28 PM 69,632 MI1129~1.EVT

Its not easily possible with the copy to trace back the short names to their long names.

Version 2 implemented a fix for this issue