name: apfs_physical_stores
platforms:
  - darwin
description: Information about APFS physical stores from the `diskutil apfs list -plist` command.
columns:
  - name: container_uuid
    type: text
    required: false
    description: The UUID of the APFS Contianer
  - name: container_designated_physical_store
    type: text
    required: false
    description: |
      The disk displayed as the backing store of the container. There may be multiple,
      use `apfs_physical_stores` to see all actual physical stores
  - name: container_reference
    type: text
    required: false
    description: The current reference for the APFS container, e.g. "disk3"
  - name: container_fusion
    type: text
    required: false
    description: Whether this container is on a "fusion drive" (i.e. SSHD)
  - name: container_capacity_ceiling
    type: bigint
    required: false
    description: The total amount of space in the container
  - name: container_capacity_free
    type: bigint
    required: false
    description: The amount of remaining free space in the container
  - name: uuid
    type: text
    required: false
    description: The UUID of the physical store
  - name: identifier
    type: text
    required: false
    description: The current identifier of the physical store (e.g. disk1s2)
  - name: size
    type: bigint
    required: false
    description: The size of the physical store in byptes
notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).
evented: false