Fix paths to use partition letter.

ForensicArtifacts · Jan 30, 2024 · dc1a95c · dc1a95c
1 parent 6304c2b
commit dc1a95c
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/artifacts/data/windows.yaml b/artifacts/data/windows.yaml
@@ -2051,8 +2051,8 @@ sources:
 - type: FILE
   attributes:
     paths:
-    - '\$Recycle.Bin\**'
-    - '\Recycler\**'
+    - '%%environ_systemdrive%%\$Recycle.Bin\**'
+    - '%%environ_systemdrive%%\Recycler\**'
     separator: '\'
 supported_os: [Windows]
 urls: ['https://forensics.wiki/windows#recycle-bin']
@@ -2063,8 +2063,8 @@ sources:
 - type: FILE
   attributes:
     paths:
-    - '\$Recycle.Bin\*\$I*'
-    - '\Recycler\*\INFO2'
+    - '%%environ_systemdrive%%\$Recycle.Bin\*\$I*'
+    - '%%environ_systemdrive%%\Recycler\*\INFO2'
     separator: '\'
 supported_os: [Windows]
 urls: ['https://forensics.wiki/windows#recycle-bin']