|Applies To||RSA Product Set: ECAT|
RSA Product/Service Type: ECAT Server
RSA Version/Condition: 4.x
|Issue||What is the ECAT Server filename and directory structure of the files under the C:\ECAT\Server\Files folder?|
|Resolution||The modules downloaded from ECAT Agent machines are stored in the ECAT Server default location C:\ECAT\Server\Files folder.|
The modules downloaded reside within a sub-folder under the C:\ECAT\Server\Files folder.
Where the filename from ECAT Agent machine is renamed into a filename format of:
An example, filename:
The directory that the file is in under the C:\ECAT\Server\Files folder is a directory with the first 4 Capital characters of the file's SHA256 value.
For the above filename example the file will be in the ECAT Server folder (default) C:\ECAT\Server\Files\0B17
The C:\ECAT\Server\Files\# folder will contain the MFTs (Master File Table), and MEMORY_DRIVER files downloaded from the ECAT Agent machines.
The random alpha/numeric characters in the file name is to avoid rare cases where certain hash algorithms can result in a collision with the same hash value for different files.
The path of the downloaded module can also be shown in the ECAT UI by following the steps below.