4 ms·

Thanks for your (companies) work on both this and graphtage! Out there question: Do you guys have any plans on releasing a tool which could be used for diffin

by 22c 3y ago

Thanks for your (companies) work on both this and graphtage! Out there question: Do you guys have any plans on releasing a tool which could be used for diffing filesystems? eg. Run the tool, run an arbitrary program which modifies the filesystem, run the tool again and it reports on what has changed? Using existing diff tools for this right now is clunky. I'm surprised there's not a go-to tool used by security researchers (or perhaps there is and I don't know about it).

woodruffw 3y ago
> Do you guys have any plans on releasing a tool which could be used for diffing filesystems? I don't think we have any immediate plans for this, but it's an interesting idea. I think you could use graphtage for this (since it performs an IR transformation to do diffs against arbitrary graph-shaped inputs), provided you're able to transform your FS changes/metadata into a graph-shaped object (even just a JSON array of events). More specifically, assuming you have a journaling FS, I think you could do something like "record the journal for the period you're interested in, and then build a graph of (event, inode) items during that period." But there might be edge cases I'm not thinking of.
wisemang 3y ago
For windows I used to use a tool called regshot for this. Main use case is Windows Registry diffing (hence the name) but also supports filesystem diffing. https://github.com/Seabreg/Regshot https://github.com/Seabreg/Regshot