Join GitHub today
GitHub is home to over 31 million developers working together to host and review code, manage projects, and build software together.Sign up
Collection Filters Enhancement #103
Related to my inquiry:
Do you have any examples of plaso filters for specific files in the recycle bin? We've tried something like: /$Recycle.Bin/.+/$I30 with no success.Also have tried something like /$Recycle.Bin/.+/.+ etc to try to get everything x dirs down (this same type of pattern works in other cases)...also did not work.
Requesting support for the following two items in the collection filters:
My understanding is the current support is limited, since it does not have recursive behavior....
Hi @joachimmetz and sorry for not being precise. Now, I am not sure if this comment is in the right place/issue.
I was referring to "ADS support" from the check list above. The MFTECmd does a good job there with "Zone.Identifier", as explained in: https://binaryforay.blogspot.com/2018/06/introducing-mftecmd.html
The ads info is extracted in: https://github.com/EricZimmerman/MFT/blob/96af1eb2124824bd41b505a3ecd29cd9362978e9/MFT/Other/ExtensionMethods.cs
There are also another MFT atributes to look for, like flags. Also, the function public string GetFullParentPath(string recordKey) in https://github.com/EricZimmerman/MFT/blob/f16feea02a1d68965e68f0d3fb7bf5892d822cdd/MFT/Mft.cs
@MariasStory still unclear to me what you mean. This issue is about enhancing the collection filters. The ADS support mentioned above is to update the Collection Filter specification to allow to specify the name of an ADS. The gotcha here is the Windows ADS naming convention allows for ambiguity (when applied cross-platform). Such as how to distinguish between a filename with
I'm unfamiliar with a "flags" MFT attribute (Also see: https://github.com/libyal/libfsntfs/blob/master/documentation/New%20Technologies%20File%20System%20(NTFS).asciidoc#61-the-attribute-types). So please be more specific what you mean.
I'm skeptical this takes all edge cases into account. E.g. file A is part of directory B, file A gets deleted, directory B gets renamed to. Should the full path be "/B/A" or "/C/A" ?
I too suffer from the pain of winsxs and other "low value" files.
My workaround leverages some existing file filter features:
Some other things to bear in mind:
The following is my hacky workaround filter that excludes a lot of Windows stuff that I regard as time-wasting junk. Your view of what "junk" is will obviously be different from mine.
A cautionary note: the above doesn't distinguish between file or folders at a particular level. If you are knowingly excluding a folder /Windows/Help you could unknowingly exclude a file /Windows/help.chm, for example, which you maybe didn't mean to do. Folders like "/Windows_backup" will need some extra care.
Hope this helps and feel free to suggest improvements.