2023-05-12 20:17:10 +00:00
|
|
|
-- Returns a list of file information from Downloads directories
|
|
|
|
|
--
|
|
|
|
|
-- tags: postmortem
|
|
|
|
|
-- platform: posix
|
2023-05-17 14:54:16 +00:00
|
|
|
-- interval: 3600
|
2023-05-12 20:17:10 +00:00
|
|
|
SELECT
|
|
|
|
|
file.*,
|
|
|
|
|
magic.data,
|
|
|
|
|
hash.sha256
|
|
|
|
|
FROM
|
|
|
|
|
file
|
|
|
|
|
LEFT JOIN magic ON file.path = magic.path
|
|
|
|
|
LEFT JOIN hash ON file.path = hash.path
|
|
|
|
|
WHERE
|
2023-05-17 14:54:16 +00:00
|
|
|
(
|
|
|
|
|
file.path LIKE "/home/%/Downloads/%"
|
|
|
|
|
OR file.path LIKE "/Users/%/Downloads/%"
|
|
|
|
|
)
|
|
|
|
|
AND (
|
|
|
|
|
mtime > (strftime('%s', 'now') -3600)
|
|
|
|
|
OR ctime > (strftime('%s', 'now') -3600)
|
|
|
|
|
OR btime > (strftime('%s', 'now') -3600)
|
|
|
|
|
)
|
