Fleet’s built-in queries for collecting and storing important device information.
Apple
Linux
Windows
ChromeOS
MDM Disk encryption key file lines
Retrieves the encrypted FileVault recovery key and checks for related file data on managed macOS devices.
WITH
de AS (SELECT IFNULL((SELECT 1 FROM disk_encryption WHERE user_uuid IS NOT "" AND filevault_status = 'on' LIMIT 1), 0) as encrypted),
fl AS (SELECT line FROM file_lines WHERE path = '/var/db/FileVaultPRK.dat')
SELECT encrypted, hex(line) as hex_line FROM de LEFT JOIN fl;
This query uses the filevault_prk
data table. Learn more
Vitals