New Acquisition File Format Specification

[TheZ3ro]

MVT and AndroidQF works with a custom acquisition file format.
This format use JSON as a data structure to store many of the file and data, however on devices with limited capabilities (eg. low-end Android devices) or in other scenarios, this is not ideal since it's not possible to have a chunked-read / chunked-write of it.

Maybe Bugbane could use a custom file format when storing data internally and then convert to the MVT format once the user export and share an acquisition

[lsd-cat]

I was wondering, especially for, for instance, the directory listing with permissions, there the output is plaintext and then parsed as json. I think there's reasons, like besides the pattern matching on the filename, there could be evidences from a suspicious file with, ie: a recent date in a folder where everything has a different date, or something marked as executable that shouldn't. We can probably save the original plaintext output, do the IOC scan there, and then convert to JSON when exporting. However I'm a bit concerned about adding conversions on the fly or maintaining different format :(