KAPE: a module CSV is a parse of the copy

The row is a reading

After a package is copied, a module runs a parser over those files and writes a CSV. Each row is that parser’s fields: a path, a time, a count. It is not a second copy of the file, and it does not carry the hash of the bytes unless the parser itself printed one.

The path inside the row is where the parser says the artifact lived. On a package, that path is the path inside the copy, or the original path recorded from the copy. It is not a look at the machine today.

The package and the CSV answer different questions

The copy record answers whether a file was in the package. The module CSV answers what a parser extracted from a file it opened. Cite both when a finding uses a parsed time or a run count. Citing only the CSV drops the link to the file that was parsed.

If the CSV names a file the package listing does not contain, say so. Do not smooth that gap by assuming the parser invented a harmless alias.

What to file

File the module name, the CSV path, the row’s source path, and the fields you are using, each labeled as parser output. File the package time. Do not write that the workstation still has the file. Do not treat a parsed time as the only clock if you have not said which parser produced it.

Worked case: a notepad row and yesterday’s package

A prefetch CSV from module output says NOTEPAD.EXE last ran at 15:02 UTC, run count 4, source path ending in NOTEPAD.EXE-….pf. The package was taken the day before the note is written. A draft says the lab PC ran Notepad this morning.

The note quotes the module, the CSV row, and the package time. It says the parsed time is from the copy, not from a look at the live disk today. The finding may say the package’s prefetch recorded a last run at 15:02 UTC. It may not say the machine ran Notepad after the package was taken.

module: prefetch parser
csv row: NOTEPAD.EXE  last run 15:02 UTC  run count 4
source path: ...\NOTEPAD.EXE-....pf  (path as the parser printed it)
package taken: the day before this note
live host today: not observed