package rrg.fs

Get desktop application:
View/edit binary Protocol Buffers messages

Binary data object. Blobs are used mostly (but not exclusively) to represent contents of files: sending an entire file in one Protocol Buffers message is not feasible, so we divide files to smaller portions and deliver it to the server one by one. On the server, the blob sink stores blobs immediately in a blobstore instead of storing it in the database to be later picked up by a worker for further processing.

• bytes data = 1

  Binary data that the blob represents.

Extended attribute of a file. Note that extended attributes are not available on Windows and there are some differences between how they work on macOS and Linux. See the [Wikipedia][1] article for more details. [Wikipedia]: https://en.wikipedia.org/wiki/Extended_file_attributes

Used in: action.get_file_metadata.Result

• bytes name = 1

  A name of the article. On macOS this is an UTF-8 encoded string, but on Linux it can consist of arbitrary byte sequence (although most probably it will be also an UTF-8 string).

• bytes value = 2

  A value of the attribute. This can be an arbitrary sequence of bytes both on macOS and Linux.

Metadata associated with a specific file.

Used in: action.get_file_metadata.Result, action.get_file_metadata_kmx.Result

• FileMetadata.Type type = 1

  Type of the file.

• uint64 size = 2

  Size of the file in bytes.

• optional google.protobuf.Timestamp access_time = 3

  Time at which the file was last accessed.

• optional google.protobuf.Timestamp modification_time = 4

  Time at which the file was last modified.

• optional google.protobuf.Timestamp creation_time = 5

  Time at which the file was created.

• uint64 unix_dev = 6

  Identifier of the device containing the file (Unix-only).

• uint64 unix_ino = 7

  Inode number of the file (Unix-only).

• uint32 unix_mode = 8

  Type and rights mask of the file (Unix-only).

• uint64 unix_nlink = 9

  Number of hard links pointing to the file (Unix-only).

• uint32 unix_uid = 10

  Identifier of the user owning the file (Unix-only).

• uint32 unix_gid = 11

  Identifier of the group owning the file (Unix-only).

• uint64 unix_rdev = 12

  Identifier of the device (only for special files, Unix-only).

• uint64 unix_blksize = 13

  Block size for the filesystem I/O.

• uint64 unix_blocks = 14

  Number of blocks allocated for the file.

List of different file types.

Used in: FileMetadata

• UNKNOWN = 0

  Unknown (or unspecified).

• FILE = 1

  Regular file.

• DIR = 2

  Directory.

• SYMLINK = 3

  Symbolic link.

Information about a mounted filesystem.

Used in: action.list_mounts.Result

• string name = 1

  Name or other identifier of the mounted device.

• optional Path path = 2

  Path at which the mounted filesystem is available (a mount point).

• string fs_type = 3

  Type of the mounted filesystem (e.g. `ext4`, `ramfs`, `NTFS`).

Path in the filesystem.

Used in: action.dump_process_memory.Result, action.execute_signed_command.Command, action.get_file_contents.Args, action.get_file_contents.Result, action.get_file_contents_kmx.Args, action.get_file_contents_kmx.Result, action.get_file_metadata.Args, action.get_file_metadata.Result, action.get_file_metadata_kmx.Args, action.get_file_metadata_kmx.Result, action.get_file_sha256.Args, action.get_file_sha256.Result, action.get_filesystem_timeline.Args, action.get_filesystem_timeline_tsk.Args, action.grep_file_contents.Args, action.list_processes.Result, action.list_utmp_users.Args, Mount, startup.Startup

• bytes raw_bytes = 1

  Raw bytes representing the path. Different operating systems represent paths differently and have varying capabilities. In most general case, Linux systems allow paths with pretty much arbitrary bytes and so we need to support this case. On Windows, where paths are stored using UCS-2 encoding (that is 16-bit), represent paths with the WTF-8 encoding [1]: an "almost UTF-8". So, even if the language does not have support for WTF-8, we can treat it as UTF-8 and still get more-or-less meaningful results. [1]: https://simonsapin.github.io/wtf-8