Tables
Tables{{numberOfTablesDisplayed}}
file
Interactive filesystem attributes and metadata.
| Column | Type | Description |
|---|---|---|
| atime | bigint | Last access time |
| attributes | text | File attrib string. See: https://ss64.com/nt/attrib.html Only available on Windows |
| block_size | integer | Block size of filesystem |
| bsd_flags | text | The BSD file flags (chflags). Possible values: NODUMP, UF_IMMUTABLE, UF_APPEND, OPAQUE, HIDDEN, ARCHIVED, SF_IMMUTABLE, SF_APPEND Only available on macOS |
| btime | bigint | (B)irth or (cr)eate time |
| ctime | bigint | Last status change time |
| device | bigint | Device ID (optional) |
| directory | text | Directory of file(s) Required in WHERE clause |
| file_id | text | file ID Only available on Windows |
| file_version | text | File version Only available on Windows |
| filename | text | Name portion of file path |
| gid | bigint | Owning group ID |
| hard_links | integer | Number of hard links |
| inode | bigint | Filesystem inode number |
| mode | text | Permission bits |
| mount_namespace_id | text | Mount namespace id Only available on Linux |
| mtime | bigint | Last modification time |
| original_filename | text | (Executable files only) Original filename Only available on Windows |
| path | text | Absolute file path Required in WHERE clause |
| pid_with_namespace | integer | Pids that contain a namespace Only available on Linux |
| product_version | text | File product version Only available on Windows |
| shortcut_comment | text | Comment on the shortcut Not returned in SELECT * FROM file.Only available on windows, win32, and cygwin |
| shortcut_run | text | Window mode the target of the shortcut should be run in Not returned in SELECT * FROM file.Only available on windows, win32, and cygwin |
| shortcut_start_in | text | Full path to the working directory to use when executing the shortcut target Not returned in SELECT * FROM file.Only available on windows, win32, and cygwin |
| shortcut_target_location | text | Folder name where the shortcut target resides Not returned in SELECT * FROM file.Only available on windows, win32, and cygwin |
| shortcut_target_path | text | Full path to the file the shortcut points to Not returned in SELECT * FROM file.Only available on windows, win32, and cygwin |
| shortcut_target_type | text | Display name for the target type Not returned in SELECT * FROM file.Only available on windows, win32, and cygwin |
| size | bigint | Size of file in bytes |
| symlink | integer | 1 if the path is a symlink, otherwise 0 |
| type | text | File status |
| uid | bigint | Owning user ID |
| volume_serial | text | Volume serial number Only available on Windows |
Example
List zip files in the downloads folder as well as their associated sha256 hash.
SELECT f.path, h.sha256 FROM file f JOIN hash h ON f.path = h.path WHERE f.path LIKE '/Users/%/Downloads/%%.zip';
Edit page
Need more help?
Ask the community on Slack
SOC2 Type 2
© 2024 Fleet Inc.
Privacy
