device_hash

Similar to the hash table, but use TSK and allow block address access.

Platform support

Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: device_hash

  • Linux
  • Mac OSX

Table schema

Name Type Description
device TEXT Absolute file path to device node
partition TEXT A partition number
inode BIGINT Filesystem inode number
md5 TEXT MD5 hash of provided inode data
sha1 TEXT SHA1 hash of provided inode data
sha256 TEXT SHA256 hash of provided inode data

Query examples

Select all the results for the given table.

SELECT * FROM device_hash;