KAPE: the console count is not the path list

The line is a number

The collection console can print how many files were found and how many were copied, sometimes with a deduplicated tally. Those are counts for that run. They do not list paths. A sentence that names a prefetch file, a hive, or a log because “the package was large” is not using the console line.

The copy log is the row-by-row list. If you need a path, it comes from that list or you do not have it. The console count cannot be expanded into paths.

A deduplicated figure is still a count

A note that some files were deduplicated means the run did not store a second copy of those paths. It does not say which paths, and it does not say those paths were harmless. The figure is arithmetic. The identities are in the log.

If the console line was not saved, write “console count not saved.” Do not reconstruct a number from the size of the virtual disk.

What to file

File the console tally with the run time and the package name, labeled as a count. File any path from the copy log, labeled as a log row. Do not file a path that appears in neither.

Worked case: six hundred files, one imagined hive

The console for package LAB-02 says 640 files copied, 12 deduplicated. The copy log’s rows that were opened do not include a SAM hive. A draft says the package contains the SAM hive because a triage of that size usually does.

The note quotes 640 and 12 as counts. It says the SAM path was not in the rows that were checked, so it is not claimed. The usual contents of a target are not this run’s list. The hive stays off the finding until a copy-log row names it.

package: LAB-02
console: 640 copied, 12 deduplicated
paths named by those numbers: none
SAM in the rows checked: no
write: counts only
not: the hive was collected