postprocessing extracted files

Zeek
1

Hi.

I want to use Bro to extract files. After extraction these files will undergo some post-processing (e.g. lookup in a db of known files). Can I be sure, that a file logged in files.log with its hash has been written to disk completely?

If not, I have two ideas how to solve this:

  1. use a temporary filename until the file is completely written (like a prefix/postfix). exclude temporary files from post-processing.
  2. emit an appropriate signal from Extract::~Extract() after the file is closed.

I would be happy to implement a solution.

Franky

2

You can handle the file_state_remove event. At that point, everything about the file is complete and it’s being flushed from memory.

event file_state_remove(f: fa_file)
  {
  # Do what you need.
  }

  .Seth

3

Hi,