What is file and directory discovery?¶
File and directory discovery is activity used to identify folders, files, shares or repositories that may contain useful information.
Avoid the dangerous assumption¶
The dangerous assumption is that listing a directory proves the files were opened, copied or stolen.
It does not.
An offender may search for:
- documents
- credentials
- financial records
- source code
- backups
- configuration files
- shared folders
- cloud-synchronised data
- user profiles
- archives.
Evidence may include:
- directory-listing commands
- file-search queries
- application logs
- share access
- cloud audit records
- endpoint telemetry
- search histories
- subsequent file-access events.
Investigators should separate:
- discovering a path
- listing filenames
- opening a file
- copying or archiving it
- transferring it elsewhere.
Each stage may create different evidence.
Legitimate users, search indexing, backup systems and security tools may also enumerate files.
The context, account, target and sequence therefore matter.
A broad search for specific extensions or keywords immediately before archive creation may support a collection hypothesis.
An ordinary application listing its working directory may not.
Do not assume the account holder personally performed the search. Automation, scripts, malware or remote control may be involved.
Search terms can be especially important. Queries for filenames, extensions, customer names, financial terms or credentials may show what information was being sought, but should not be treated as proof that matching files were opened or taken.
Where search tools create indexes, caches or recent-item records, preserve them because they may show the scope and timing of the search.
Operational takeaway¶
Treat file and directory discovery as evidence of locating potential data, and prove access, collection and transfer separately.