Getting file information
Let's begin with something simple. This program will print the information about a file, namely when it was last modified, who owns it, how many bytes it is, and what its permissions are. This will also serve as a good test to make sure that your Go development environment is set up properly.
If an investigator has found an anomalous file, the first thing to do is to check all the basic metadata. This will give information about who owns the file, what groups have access to it, when it was last modified, whether it is an executable file, and how large it is. All of this information is potentially useful.
The primary function we'll use is os.Stat(). This returns a FileInfo struct, which we will print. We have to import ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access