Interactive filesystem attributes and metadata.

Platform support

Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: file

  • Windows
  • Linux
  • Mac OSX
  • Free BSD

Table schema

Name Type Description
path TEXT Absolute file path
directory TEXT Directory of file(s)
filename TEXT Name portion of file path
inode BIGINT Filesystem inode number
uid BIGINT Owning user ID
gid BIGINT Owning group ID
mode TEXT Permission bits
device BIGINT Device ID (optional)
size BIGINT Size of file in bytes
block_size INTEGER Block size of filesystem
atime BIGINT Last access time
mtime BIGINT Last modification time
ctime BIGINT Last status change time
btime BIGINT (B)irth or (cr)eate time
hard_links INTEGER Number of hard links
symlink INTEGER 1 if the path is a symlink, otherwise 0
type TEXT File status
attributes TEXT File attrib string. See:
volume_serial TEXT Volume serial number
file_id TEXT file ID

Query examples

select * from file where path = '/etc/passwd'
select * from file where directory = '/etc/'
select * from file where path LIKE '/etc/%'