package rrg.action.get_filesystem_timeline_tsk
Get desktop application:
View/edit binary Protocol Buffers messages
optional raw_fs = 1
Optional. Absolute path to the raw filesystem image to delve into. If unset, RRG will attempt to detect the path to the raw filesystem image based on system mountpoints.
optional root = 2
Absolute path to the root directory in the image to get the timeline of.
bytes blob_sha256 = 1
A SHA-256 hash of the timeline batch sent to the blob sink. Because the entire timeline can easily have millions of entries, it could quickly exceed the maximum allowed size for a message. This is why entries are batched, gzipped and then send as blobs to the blobstore.
uint64 entry_count = 2
The total number of entries in the chunk. This number includes only entries contained in the chunk corresponding to this result, not the total number of entries the action execution processed so far.