How to use DiskPartition?

Open vikhari opened this issue 7 years ago • 0 comments

Issue ported from old casework github repo (issue 18). Original author: casework

So DiskPartition has the following properties:

mountPoint
partitionID
partitionLength
partitionOffset
spaceLeft
spaceUsed
totalSpace
diskPartitionType
createdTime

These properties seem to suggest that this property bundle should be placed in a Trace. However, in plaso's use case, it needs to be placed in a Relationship object and only use a subset of these properties (image -> partOffset = 4 -> the partition) Should we create two separate property bundles like we did with File and PathRelation?

Apr 13 '18 16:04 vikhari