Added file.drive_letter

[webmat]

No description provided.

[dcode]

My only hesitation on this is that drive_letter is very OS specific. Something like filesystem_root might be more agnostic, but you can't tell that directly from a path. From a POSIX stat call on a given file, you would know what device that file existed on (and its inode). You can essentially get almost this same information with a Windows stat call (see _stat structure), but by convention this isn't as common, I think.

For a given Linux file, for counter example, it might be nice to know that a binary existed in a filesystem mounted at /home, which existed on /dev/sda5. You can't tell that from directly looking at the path, but if I'm populating data from an agent on a system, that information would be available via the mount table and/or stat call.

At the end of the day, we're trying to facilitate analysis of the data though, not to be pedantically correct. So, I think this is a reasonable approach to facilitate analysis, but I wanted to share food for thought to see if others had a better abstraction.

[NeilADesai]

There are also times where someone on a Windows host might access the drives without using the drive letter: https://support.microsoft.com/en-us/help/100027/info-direct-drive-access-under-win32. I have seen this used in forensics and by malicious users/software.

[webmat]

@NeilADesai Actually we already have file.device, whose definition right now is pretty Linux specific. Do you think it would make sense to expand its definition for capturing drives such as \\.\PhysicalDrive1 in there? Is it the canonical ID of the drive? The drive numbering sounds ephemeral to me (haven't read the whole thing).

[webmat]

I'm satisfied with this one. I'm ready to merge.

Just waiting for official reviews :-)

[andrewkroh]

I think the docs should mention this is a Windows concept to alleviate any confusion on the part of implementers working on non-Windows file info.

[webmat]

@andrewkroh Done.

Do you see any issue with stripping off the :?

[andrewkroh]

No issue. It doesn't provide any additional information.