google / google/grr

Enhanced File Information

Open
#33 2 comments 0 reactions 0 assignees View on GitHub
enhancement Priority-Medium
Dominant language
Python
Stars
5.1k
Forks
796
PR merge metrics
No merged PRs in 30d

Description

_From [sean.gillespie.32](https://code.google.com/u/115392754035860330392/) on October 06, 2014 14:51:35_

Can the following features be added to file data?
1. Support for all 8 timestamps associated with NTFS for Windows hosts since all of the timestamps are used for determining what actions have been taken or if there are any anomalies.
2. Support for filemagic file identification. This would allow rapid identification of interesting files in listings as well as specific searches such as rar files in system directories.
3. Support for PEHeader parsing. Imports, Exports, and VersionInfo are extremely useful for detecting malicious files.

These should all be pretty light weight client actions that would have a lower impact when used than acquiring all of the files before processing them.

_Original issue: http://code.google.com/p/grr/issues/detail?id=120_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.