WindowsFileObjectTypeWin File Object Schema

The object_reference field specifies a unique ID reference to an Object defined elsewhere. This construct allows for the re-use of the defined Properties of one Object within another, without the need to embed the full Object in the location from which it is being referenced. Thus, this ID reference is intended to resolve to the Properties of the Object that it points to.

The Custom_Properties construct is optional and enables the specification of a set of custom Object Properties that may not be defined in existing Properties schemas.

The is_packed field is used to indicate whether the file is packed or not.

The is_masqueraded field specifies whether the file is masqueraded as another type of file; e.g., a PDF file that has had its extension changed to TXT to masquerade itself as a text file.

The File_Name field specifies the base name of the file (including an extension, if present).

The File_Path field specifies the relative or fully-qualified path to the file, not including the path to the device where the file system containing the file resides. Whether the path is relative or fully-qualified can be specified via the 'fully_qualified' attribute of this field. The File_Path field may include the name of the file; if so, it must not conflict with the File_Name field. If not, the File_Path field should contain the path of the directory containing the file, and should end with a terminating path separator("\" or "/").

The Device_Path field specifies the path to the physical device where the file system containing the file resides.

The Full_Path field specifies the complete path to the file, including the device path. It should contain the contents that would otherwise be in the Device_Path and File_Path fields, and can be used in case the producer is unable or does not wish to separate the Device_Path and File_Path fields. If the Full_Path field is specified along with the File_Path and/or Device_Path fields, it must not conflict with either. The Full_Path field may include the name of the file; if so, it must not conflict with the File_Name field. If not, the File_Path field should contain the path of the directory containing the file, and should end with a terminating path separator("\" or "/").

The File_Extension field specifies the extension of the name of the file. The File_Extension field must not conflict with the ending of the File_Name field. The File_Extension field should not begin with a "." character, but may contain a "." character in the case of a compound file extension, such as "tar.gz".

The Size_In_Bytes field specifies the size of the file, in bytes.

The Magic_Number specifies the particular magic number (typically a hexadecimal constant used to identify a file format) corresponding to the file, if applicable.

The File_Format field specifies the particular file format of the file, most typically specified by a tool such as the UNIX file command.

The Hashes field specifies any hashes of the file.

The Digital_Signatures field is optional and captures one or more digital signatures for the file.

The Modified_Time field specifies the date/time the file was last modified.

The Accessed_Time field specifies the date/time the file was last accessed.

The Created_Time field specifies the date/time the file was created.

The File_Attributes_List field specifies the particular special attributes set for the file. Since this is a platform-specific Object property, it is defined here as an abstract type and then implemented in any platform specific derived file objects.

The Permissions field specifies that particular permissions that a file may have. Since this is a platform-specific Object property, it is defined here as an abstract type and then implemented in any platform specific derived file objects.

The User_Owner field specifies the name of the user that owns the file.

The Packer_List field specifies any packers that the file may be packed with. The term 'packer' here refers to packers, as well as things like archivers and installers.

The Peak_Entropy field specifies the calculated peak entropy of the file.

The Sym_Links field specifies any symbolic links that may exist for the file.

The Byte_Runs field contains a list of byte runs from the raw file or its storage medium.

A description of features extracted from this file.

The Encryption_Algorithm field specifies the algorithm used to encrypt the file.

The Decryption_Key field specifies the key used to decrypt the file.

The Compression_Method field specifies the method used to compress the file.

The Compression_Version field specifies the version of the compression method used to compress the file.

The Compression_Comment field specifies the comment string associated with the compressed file.

The Filename_Accessed_Time field specifies the date/time the filename of the Windows file was last accessed.

The Filename_Created_Time field specifies the date/time the filename of the Windows file was created.

The Filename_Modified_Time field specifies the date/time the filename of the Windows file was last modified.

The Drive field specifies the drive letter of the drive that the file resides on.

The Security_ID field specifies the Security ID (SID) value assigned to the file.

The Security_Type field specifies the type of Security ID (SID) assigned to the file.

The Stream_List field specifies any alternate data streams contained within the file.