Files

File forensics is important because an attacker may leave behind traces, and the evidence needs to be gathered before any more changes are made or any information is lost. This includes determining who owns a file, when it was last changed, who has access to it, and seeing whether there is any hidden data in a file.

Getting file information

Let's begin with something simple. This program will print the information about a file, namely when it was last modified, who owns it, how many bytes it is, and what its permissions are. This will also serve as a good test to make sure that your Go development environment is set up properly.

If an investigator has found an anomalous file, the first thing to do is to check all...