FileSystem
NTFS ACL + SMB share discovery that captures permission rows carrying the
What it does
Walks SMB shares (or explicit scan paths) and their NTFS DACLs and emits the static CSVs the FileSystem discovery view + the appliance re-ACL pipeline (SPEC-116) consume. The load-bearing field is the raw `trusteeSid` (S-1-... value) on every permission row: without it SPEC-116 has no source SID to map. Trustee *names* are best-effort (they are often unresolvable for accounts from a defunct/source domain) and never abort an ACE row. ENRICHMENT: Pure testable mapper functions separate data transformation from collection logic. Multi-strategy collection with graceful fallback ensures robustness across diverse environments. Scale strategy (the make-or-break for real file servers): NTFS DACLs are captured only at the share root and at folders where inheritance is broken (`AreAccessRulesProtected`). Inherited-only folders/files produce no rows. A naive per-file walk is infeasible on a real server and is intentionally NOT done here. Bounded by maxDepth / excludePaths; reparse points (junctions) are skipped to avoid cycles.
How the app exposes it
The module runs through the ACQI discovery orchestrator and writes its rows into a dedicated results view. From there, conflicts, dependencies, and readiness scores feed the deal-wide consolidation layer.
/discovered/file-system Outputs
Each module emits a normalised CSV keyed by entity ID with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact column set varies by module — the app's results view shows the live schema.