Windows Capability Access Manager database parser

[qmadev]

The Capability Access Manager database is an artifact that stores information about which apps used which resources. An example would be which apps used the webcam or microphone. This database is present as of Windows 11.

References

• https://medium.com/@cyber.sundae.dfir/capabilityaccessmanager-db-deep-dive-part-1-ff49f69c58af

[Horofic]

Hey @qmadev thanks for creating this issue! Seems like a cool new artefact, and a good addition to Dissect. Is this something you are willing to contribute in the form of a Pull Request?

[qmadev]

hey @Horofic, maybe in the future. I already submitted a PR for similar artefacts that reside in registry (#979). This database would need a separate parser.

[Horofic]

Thank you for the initial PR, I will take a look at it tomorrow! As far as the separate parser goes, I took a cursory look at the link you provided. The database seems to be SQLite based, we have a separate project dissect.sql that is able to parse SQLite databases. This should help if you decide to pick up that part!