device_hash

Similar to the hash table, but use TSK and allow block address access.

Platform support

Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: device_hash

  • Linux

  • Mac OSX

Table schema

Name

Type

Description

device

TEXT

Absolute file path to device node

partition

TEXT

A partition number

inode

BIGINT

Filesystem inode number

md5

TEXT

MD5 hash of provided inode data

sha1

TEXT

SHA1 hash of provided inode data

sha256

TEXT

SHA256 hash of provided inode data

Query examples

Select all the results for the given table.

SELECT * FROM device_hash;