Issue ported from old casework github repo (issue 18).Original author: casework
So DiskPartition has the following properties:
mountPoint
partitionID
partitionLength
partitionOffset
spaceLeft
spaceUsed
totalSpace
diskPartitionType
createdTime
These properties seem to suggest that this property bundle should be placed in a Trace.
However, in plaso's use case, it needs to be placed in a Relationship object and only use a subset of these properties
(image -> partOffset = 4 -> the partition)
Should we create two separate property bundles like we did with File and PathRelation?
Issue ported from old casework github repo (issue 18). Original author: casework
So DiskPartition has the following properties:
These properties seem to suggest that this property bundle should be placed in a Trace. However, in plaso's use case, it needs to be placed in a Relationship object and only use a subset of these properties (image -> partOffset = 4 -> the partition) Should we create two separate property bundles like we did with File and PathRelation?