Storage ● Sealed v1.0 (treated)

FileSystem

NTFS ACL + SMB share discovery that captures permission rows carrying the

What it does

Walks SMB shares (or explicit scan paths) and their NTFS DACLs and emits the static CSVs the FileSystem discovery view + the appliance re-ACL pipeline (SPEC-116) consume. The load-bearing field is the raw `trusteeSid` (S-1-... value) on every permission row: without it SPEC-116 has no source SID to map. Trustee *names* are best-effort (they are often unresolvable for accounts from a defunct/source domain) and never abort an ACE row. ENRICHMENT: Pure testable mapper functions separate data transformation from collection logic. Multi-strategy collection with graceful fallback ensures robustness across diverse environments. Scale strategy (the make-or-break for real file servers): NTFS DACLs are captured only at the share root and at folders where inheritance is broken (`AreAccessRulesProtected`). Inherited-only folders/files produce no rows. A naive per-file walk is infeasible on a real server and is intentionally NOT done here. Bounded by maxDepth / excludePaths; reparse points (junctions) are skipped to avoid cycles.

How the app exposes it

The module runs through the ACQI discovery orchestrator and writes its rows into a dedicated results view. From there, conflicts, dependencies, and readiness scores feed the deal-wide consolidation layer.

Route in app:
/discovered/file-system

Outputs

Each module emits a normalised CSV keyed by entity ID with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact column set varies by module — the app's results view shows the live schema.