Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CHANGE] Create a table for file system artifacts #119

Open
steffenfritz opened this issue Nov 13, 2024 · 1 comment
Open

[CHANGE] Create a table for file system artifacts #119

steffenfritz opened this issue Nov 13, 2024 · 1 comment
Assignees
Labels
enhancement New feature or request
Milestone

Comments

@steffenfritz
Copy link
Owner

Is your feature request related to a problem? Please describe.
FileTrove will find artifacts that are not files nor directories, but maybe relevant and the information should not be lost, e.g. named pipes.

The idea is to create a table with this schema

uuid | sessionuuid | path | registry | type | description

where

type = {named_pipe, socket, block_device, link, ...}. 

and we can use

b      block (buffered) special
c      character (unbuffered) special
[d     directory]
p      named pipe (FIFO)
[f     regular file]
l      symbolic  link [?]
s      socket
D      door (Solaris)

as type labels. These match mostly the string representations of file mode bits.

See also: #112 (comment)

@steffenfritz steffenfritz added the enhancement New feature or request label Nov 13, 2024
@steffenfritz steffenfritz self-assigned this Nov 13, 2024
@steffenfritz steffenfritz added this to the v1.0.0-BETA.4 milestone Dec 12, 2024
@steffenfritz
Copy link
Owner Author

For some special cases like "System Volume Information" on NTFS in combination with non-native NTFS operating systems filepath.WalkDir might fail. These cases should not cancel the run and write these types also into the artifacts table.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

When branches are created from issues, their pull requests are automatically linked.

1 participant