Lnk metadata extraction #2308
Open
Lnk metadata extraction #2308
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
referenced item to make the reference.
to search for items in the case later.
reference to any correspondent found item in case. The search is first based on metaAddress (mft idx) and latter, if not successfull, on relative path, after removing any volume letter info. The creationDate info is compared to confirm the match.
|
I decided to extract source MAC timestamps info registered inside LNK only if they differ from source, or if the source could not be found in the case. It is ready for review @lfcnassif |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Extracts some info from LNK to save as metadata. They are useful to order and groups LNK files.
Also, some info is used to make the reference to the original file, if found. The suggested code uses the following rule:
It is not implemented (yet) but maybe some timestamp info can be extracted if considered relevant. I am not sure if the timestamps in LNK files are correspondent to the item when it was last opened using the LNK or when the LNK was created the first time.