Sorry to bug you again. Everything has been working good from Linux since I got the versions squared away. Now I'm having an issue when trying to capture from WinPE using your Windows binaries. When trying to capture Windows 10 Build 1703 the following error is displayed.
[ERROR] "C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.15063.0_none_49a4f8dbda83d75d\powershell_ise.exe": Can't read object ID (status=c0000034): Object Name not found
ERROR: Exiting with error code 63:
Could not read the metadata for a file or directory.
I tried excluding \Windows\WinSxs and it went further. It got to c:\windows\system32\WindowsPowerShell\v1.0\powershell_ise.exe and then reported the same error. It apparently doesn't like powershell_ise.exe for some reason.
Just wondering if I'm doing something else wrong. As far as I know it's version 1.12.0.
Well, Windows is returning a strange error code which I haven't seen used in that situation. But I'm not able to reproduce the problem. Given a fresh Windows 10 Build 1703 installation, I tried capturing from the Windows PE included in the installation media, from an older Windows PE (Windows 7), and from the live system using --snapshot. None of the commands failed (and the "powershell_ise.exe" file does in fact have an Object ID).