device_hash

Similar to the hash table, but use TSK and allow block address access.

Platform support

Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: device_hash

• Linux

• Mac OSX

Table schema

Name	Type	Description
device	TEXT	Absolute file path to device node
partition	TEXT	A partition number
inode	BIGINT	Filesystem inode number
md5	TEXT	MD5 hash of provided inode data
sha1	TEXT	SHA1 hash of provided inode data
sha256	TEXT	SHA256 hash of provided inode data

Query examples

Select all the results for the given table.

SELECT * FROM device_hash;