File and Directory Discovery
File and directory discovery maps available storage locations and names before targeted collection or execution.
What it means
File and directory discovery maps available storage locations and names before targeted collection or execution. Enumeration differs from reading the contents of every discovered file.
An investigation example
A newly introduced script recursively lists departmental folders and later accesses only selected document types.
Evidence to examine
Review traversal scope, account permissions, process ancestry, selected file patterns, and later collection artifacts.
A common analytical pitfall
A directory listing does not prove file contents were read or transferred.
Response considerations
Determine which resources were merely enumerated and which were accessed, preserving that distinction in incident reporting.
Names can guide collection without revealing content
Listing files and directories can reveal application structure, user workspaces, shared resources, and potentially valuable information. It is different from reading every file's content or copying data elsewhere. The distinction matters in an investigation: a directory listing may show what a process could identify, while later file-access and transfer evidence address what it actually obtained.
Routine software frequently examines directories. Indexers, backup agents, installers, and file managers can all generate broad activity. Evaluate the requesting process, account, path scope, timing, and expected purpose. A large number of file events is not automatically malicious, while a narrowly targeted search can still be important in the right context.
A fictional assessment-folder search
An academy sees an unfamiliar process traverse several user folders and then access a restricted assessment directory. Analysts compare process ancestry, permission outcomes, file operations, and approved administrative activity. The sequence may suggest targeted collection, but a failed read should not be reported as successful acquisition of the assessment content.
Paths also require interpretation. Mapped drives, symbolic links, mounts, and application views can present the same underlying location through different names. Record enough source context to avoid counting one location twice or confusing a local path with remote storage. The logs may show only selected operations, so make coverage limits explicit.
Trace discovery to use
Create fictional events for a directory listing, a file read, and a network transfer. State the narrow claim each supports and which additional evidence would connect them. Include a benign indexing process as a comparison. Do not assume that the same timestamp or filename is sufficient to prove a complete collection chain.
A useful report also distinguishes the population searched from the population successfully accessed. Permission denials can help show a boundary held, but missing events may simply reflect logging configuration. Preserve relevant path and process details while minimizing unnecessary disclosure of private filenames in broadly shared summaries.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1083: File and Directory Discovery