diff --git a/dftimewolf/lib/collectors/grr_hosts.py b/dftimewolf/lib/collectors/grr_hosts.py index a8346706b..239e3d916 100644 --- a/dftimewolf/lib/collectors/grr_hosts.py +++ b/dftimewolf/lib/collectors/grr_hosts.py @@ -858,10 +858,6 @@ def Process(self, container: containers.Host if not artifact_list: return - if client.data.os_info.system.lower() == 'windows': - self.logger.debug("Switching to raw filesystem access for Windows.") - self.use_raw_filesystem_access = True - flow_args = flows_pb2.ArtifactCollectorFlowArgs( artifact_list=artifact_list, use_raw_filesystem_access=self.use_raw_filesystem_access, diff --git a/tests/lib/collectors/grr_hosts.py b/tests/lib/collectors/grr_hosts.py index d7c529e91..133c4c5d1 100644 --- a/tests/lib/collectors/grr_hosts.py +++ b/tests/lib/collectors/grr_hosts.py @@ -302,8 +302,7 @@ def testProcessWindowsArtifacts(self, self.grr_artifact_collector.PostProcess() kwargs = mock_ArtifactCollectorFlowArgs.call_args[1] - # Raw access for Windows - self.assertTrue(kwargs['use_raw_filesystem_access']) + self.assertFalse(kwargs["use_raw_filesystem_access"]) @mock.patch('grr_api_client.api.InitHttp') @mock.patch('grr_api_client.flow.FlowRef.Get')