steffenfritz / FileTrove

FileTrove indexes files and creates metadata from them.
https://filetrove.fritz.wtf
GNU Affero General Public License v3.0
37 stars 5 forks source link

[CHANGE] Create a table for file system artifacts #119

Open steffenfritz opened 2 weeks ago

steffenfritz commented 2 weeks ago

Is your feature request related to a problem? Please describe. FileTrove will find artifacts that are not files nor directories, but maybe relevant and the information should not be lost, e.g. named pipes.

The idea is to create a table with this schema

uuid | sessionuuid | path | registry | type | description

where

type = {named_pipe, socket, block_device, link, ...}. 

and we can use

b      block (buffered) special
c      character (unbuffered) special
[d     directory]
p      named pipe (FIFO)
[f     regular file]
l      symbolic  link [?]
s      socket
D      door (Solaris)

as type labels. These match mostly the string representations of file mode bits.

See also: https://github.com/steffenfritz/FileTrove/issues/112#issuecomment-2470078853