diff --git a/src/detection/disk/disk.h b/src/detection/disk/disk.h index d288c8365..dc70bb88a 100644 --- a/src/detection/disk/disk.h +++ b/src/detection/disk/disk.h @@ -17,6 +17,8 @@ typedef struct FFDisk uint32_t filesUsed; uint32_t filesTotal; + + uint64_t createTime; } FFDisk; /** diff --git a/src/detection/disk/disk_bsd.c b/src/detection/disk/disk_bsd.c index 8584530e9..c6f9a1c82 100644 --- a/src/detection/disk/disk_bsd.c +++ b/src/detection/disk/disk_bsd.c @@ -3,6 +3,7 @@ #include "util/stringUtils.h" #include +#include #ifdef __FreeBSD__ #include @@ -130,6 +131,10 @@ const char* ffDetectDisksImpl(FFlist* disks) if(fs->f_flags & MNT_RDONLY) disk->type |= FF_DISK_VOLUME_TYPE_READONLY_BIT; + + struct stat st; + if(stat(fs->f_mntonname, &st) == 0) + disk->createTime = (uint64_t)((st.st_birthtimespec.tv_sec * 1000) + (st.st_birthtimespec.tv_nsec / 1000000)); } return NULL; diff --git a/src/modules/disk/disk.c b/src/modules/disk/disk.c index 20c53f980..1d73a9183 100644 --- a/src/modules/disk/disk.c +++ b/src/modules/disk/disk.c @@ -6,7 +6,9 @@ #include "modules/disk/disk.h" #include "util/stringUtils.h" -#define FF_DISK_NUM_FORMAT_ARGS 11 +#include + +#define FF_DISK_NUM_FORMAT_ARGS 12 #pragma GCC diagnostic ignored "-Wsign-conversion" static void printDisk(FFDiskOptions* options, const FFDisk* disk) @@ -112,6 +114,13 @@ static void printDisk(FFDiskOptions* options, const FFDisk* disk) bool isExternal = !!(disk->type & FF_DISK_VOLUME_TYPE_EXTERNAL_BIT); bool isHidden = !!(disk->type & FF_DISK_VOLUME_TYPE_HIDDEN_BIT); bool isReadOnly = !!(disk->type & FF_DISK_VOLUME_TYPE_READONLY_BIT); + + char buf[64] = ""; + if(disk->createTime) + { + time_t time = (time_t) (disk->createTime / 1000); + strftime(buf, sizeof(buf), "%FT%T%z", localtime(&time)); + } FF_PRINT_FORMAT_CHECKED(key.chars, 0, &options->moduleArgs, FF_PRINT_TYPE_NO_CUSTOM_KEY, FF_DISK_NUM_FORMAT_ARGS, ((FFformatarg[]) { {FF_FORMAT_ARG_TYPE_STRBUF, &usedPretty}, {FF_FORMAT_ARG_TYPE_STRBUF, &totalPretty}, @@ -124,6 +133,7 @@ static void printDisk(FFDiskOptions* options, const FFDisk* disk) {FF_FORMAT_ARG_TYPE_STRBUF, &disk->filesystem}, {FF_FORMAT_ARG_TYPE_STRBUF, &disk->name}, {FF_FORMAT_ARG_TYPE_BOOL, &isReadOnly}, + {FF_FORMAT_ARG_TYPE_STRING, buf}, })); } } @@ -448,6 +458,8 @@ void ffGenerateDiskJsonResult(FFDiskOptions* options, yyjson_mut_doc* doc, yyjso yyjson_mut_arr_add_str(doc, typeArr, "Hidden"); if(item->type & FF_DISK_VOLUME_TYPE_READONLY_BIT) yyjson_mut_arr_add_str(doc, typeArr, "Read-only"); + + yyjson_mut_obj_add_uint(doc, obj, "createTime", item->createTime); } FF_LIST_FOR_EACH(FFDisk, item, disks) @@ -473,6 +485,7 @@ void ffPrintDiskHelpFormat(void) "Filesystem", "Label / name", "True if read-only", + "Create time", })); }