File System Enumeration

Overview

Evidence: File System Enumeration Description: Collect File System Enumeration Category: File System Platform: Linux Short Name: filesyst Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Linux file system enumeration provides comprehensive information about files, directories, and file system structure. This data is essential for understanding file system state and detecting unauthorized file modifications.

Data Collected

This collector gathers structured data about file system enumeration.

File System Enumeration Data

Field	Description	Example
ID	Primary key (auto-increment)	1
Path	File path	/etc/passwd
Type	File type	regular file
Size	File size in bytes	2048
Permissions	File permissions	644
Owner	File owner	root
Group	File group	root
Modified	Last modified time	2023-10-15 14:30:25
Accessed	Last accessed time	2023-10-15 14:30:25
Created	Creation time	2023-10-15 14:30:25

Collection Method

This collector parses the necessary data from the file_system_enumeration table.

Usage

This evidence is crucial for forensic investigations as it provides file system information. It helps investigators understand file system state, detect unauthorized file modifications, and investigate file-based attacks. The data can reveal file changes, directory structures, and potential file system vulnerabilities. Analysts can use this information to identify file system compromises, trace file activities, and assess file system security posture.

Notes

This data may contain sensitive information that should be handled according to data protection requirements. Ensure proper chain of custody is maintained during collection and analysis.