mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-08 10:23:54 +00:00
d4a3fe2452
Preparation for Windows Tables. We need a Windows process table so that the daemon will run
21 lines
1.0 KiB
Plaintext
21 lines
1.0 KiB
Plaintext
table_name("device_file")
|
|
description("Similar to the file table, but use TSK and allow block address access.")
|
|
schema([
|
|
Column("device", TEXT, "Absolute file path to device node", required=True),
|
|
Column("partition", TEXT, "A partition number", required=True),
|
|
Column("path", TEXT, "A logical path within the device node", additional=True),
|
|
Column("filename", TEXT, "Name portion of file path"),
|
|
Column("inode", BIGINT, "Filesystem inode number"),
|
|
Column("uid", BIGINT, "Owning user ID"),
|
|
Column("gid", BIGINT, "Owning group ID"),
|
|
Column("mode", TEXT, "Permission bits"),
|
|
Column("size", BIGINT, "Size of file in bytes"),
|
|
Column("block_size", INTEGER, "Block size of filesystem"),
|
|
Column("atime", BIGINT, "Last access time"),
|
|
Column("mtime", BIGINT, "Last modification time"),
|
|
Column("ctime", BIGINT, "Creation time"),
|
|
Column("hard_links", INTEGER, "Number of hard links"),
|
|
Column("type", TEXT, "File status"),
|
|
])
|
|
implementation("forensic/sleuthkit@genDeviceFile")
|