Enhanced File Information
- Dominant language
- Python
- Stars
- 5.1k
- Forks
- 796
- PR merge metrics
- No merged PRs in 30d
Description
_From [sean.gillespie.32](https://code.google.com/u/115392754035860330392/) on October 06, 2014 14:51:35_
Can the following features be added to file data?
1. Support for all 8 timestamps associated with NTFS for Windows hosts since all of the timestamps are used for determining what actions have been taken or if there are any anomalies.
2. Support for filemagic file identification. This would allow rapid identification of interesting files in listings as well as specific searches such as rar files in system directories.
3. Support for PEHeader parsing. Imports, Exports, and VersionInfo are extremely useful for detecting malicious files.
These should all be pretty light weight client actions that would have a lower impact when used than acquiring all of the files before processing them.
_Original issue: http://code.google.com/p/grr/issues/detail?id=120_
Contributor guide
Assessment
This issue has not been assessed yet.