FileRec

Page Layout

The file page has the common three panel layout of menu overlay, facet and workspace.

Files are tracked by their MD5 names. Names are not associated with an MD5, as this information is inconsistently related to the flow.

Fields in the Table

Field

Description

MD5

The MD5 file hash is the derived key used to track the file in database. The SHA256 is also kept.

File Type

The passive scan file type.

Size

Size in bytes.

Positives

Number of Antivirus engines that returned a positive result (a match).

Bandwidth

Amount of total bandwidth of flows this file was associated with being transferred.

Source Address

The network source addresses.

Destination Address

The network destination address.

Host Connected

Host name, if given during the session.

Countries

By Geo IP address lookup of the file's source.