Difference between revisions of "File Table"
| (4 intermediate revisions by the same user not shown) | |||
| Line 31: | Line 31: | ||
==<code>MediaID</code>== | ==<code>MediaID</code>== | ||
| − | The globally unique identifier of the Media this file came from. It corresponds to the ID column of the <code>[Media]</code> table. | + | The globally unique identifier of the Media this file came from. |
| + | It corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[Media Table|Media]]<nowiki>]</nowiki></code> table. | ||
==<code>ParentFileID</code>== | ==<code>ParentFileID</code>== | ||
| − | The globally unique identifier that is the parent of this file. This corresponds to the ID column of the <code>[File]</code> table. | + | The globally unique identifier that is the parent of this file. |
| + | This corresponds to the <code>[ID]</code> column of the <code>[File]</code> table. | ||
==<code>Attributes</code>== | ==<code>Attributes</code>== | ||
| Line 40: | Line 42: | ||
==<code>RawEntropy</code>== | ==<code>RawEntropy</code>== | ||
| − | The [https://en.wikipedia.org/wiki/Entropy_(information_theory) Shannon's Raw Entropy] value representing the roughness of the data contained in the file's contents. | + | The [https://en.wikipedia.org/wiki/Entropy_(information_theory) Shannon's Raw Entropy] value representing the roughness of the data contained in the file's contents. |
==<code>OSLength</code>== | ==<code>OSLength</code>== | ||
| Line 52: | Line 54: | ||
==<code>OriginID</code>== | ==<code>OriginID</code>== | ||
| − | Where this file came from. Normal, Deleted, Carved, etc. It corresponds to the <code>ID</code> column of the <code>[Origin]</code> table. | + | Where this file came from. Normal, Deleted, Carved, etc. |
| + | It corresponds to the <code>[ID]</code> column of the <code>[Origin]</code> table. | ||
| + | It should contain one of [[Origin|these]] values. | ||
==<code>ContentStatusID</code>== | ==<code>ContentStatusID</code>== | ||
| − | The identifier of the content status. This corresponds to the <code>ID</code> column of the <code>[ContentStatus]</code> table. 0 - Unknown, 1 - Original (present), 4 - eliminated by hash, 5 - duplicate eliminated. | + | The identifier of the content status. |
| + | This corresponds to the <code>[ID]</code> column of the <code>[ContentStatus]</code> table. | ||
| + | 0 - Unknown, 1 - Original (present), 4 - eliminated by hash, 5 - duplicate eliminated. | ||
| + | It should contain one of [[Content_Status|these]] values. | ||
==<code>Created</code>== | ==<code>Created</code>== | ||
| Line 67: | Line 74: | ||
==<code>FilenameID</code>== | ==<code>FilenameID</code>== | ||
| − | Links the name of this file to a record in the Filename table with this <code>ID</code> value. It corresponds to the <code>ID</code> column of the <code>[Filename]</code> table. | + | Links the name of this file to a record in the Filename table with this <code>[ID]</code> value. |
| + | It corresponds to the <code>[ID]</code> column of the <code>[Filename]</code> table. | ||
==<code>FileTypeID</code>== | ==<code>FileTypeID</code>== | ||
| − | The type of the file. This column corresponds to the <code>ID</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table. | + | The type of the file. |
| + | This column corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table. | ||
==<code>PhysicalDiskOffset</code>== | ==<code>PhysicalDiskOffset</code>== | ||
| Line 76: | Line 85: | ||
==<code>NumberOfChildren</code>== | ==<code>NumberOfChildren</code>== | ||
| − | This field is greater than zero if there are other records whose <code>ParentFileID</code> matches this record's <code>ID</code> field. | + | This field is greater than zero if there are other records whose <code>[ParentFileID]</code> matches this record's <code>[ID]</code> field. |
==<code>FullPathID</code>== | ==<code>FullPathID</code>== | ||
| − | Links the full path of this file to a record in the Filename table with this ID value. It corresponds to the <code>ID</code> column of the <code>[Filename]</code> table. | + | Links the full path of this file to a record in the <code>[Filename]</code> table with this <code>[ID]</code> value. |
| + | It corresponds to the <code>[ID]</code> column of the <code>[Filename]</code> table. | ||
Latest revision as of 07:23, 3 February 2024
The [File] table holds the meta data information about a file.
Contents
SQL
CREATE TABLE "File"
(
"ID" uuid NOT NULL,
"MediaID" uuid NOT NULL,
"ParentFileID" uuid NOT NULL,
"Attributes" integer DEFAULT 0 NOT NULL,
"RawEntropy" smallint DEFAULT 0 NOT NULL,
"OSLength" bigint DEFAULT 0 NOT NULL,
"HashID" uuid NOT NULL,
"Signature" integer DEFAULT 0 NOT NULL,
"OriginID" smallint DEFAULT 0 NOT NULL,
"ContentStatusID" smallint DEFAULT 0 NOT NULL,
"Created" timestamp without time zone NOT NULL,
"LastAccess" timestamp without time zone NOT NULL,
"LastWrite" timestamp without time zone NOT NULL,
"FilenameID" bigint DEFAULT 0 NOT NULL,
"FileTypeID" smallint DEFAULT 0 NOT NULL,
"PhysicalDiskOffset" bigint DEFAULT 0 NOT NULL,
"NumberOfChildren" integer DEFAULT 0 NOT NULL,
"FullPathID" bigint DEFAULT 0 NOT NULL
);
Columns
ID
A globally unique identifier for this record.
MediaID
The globally unique identifier of the Media this file came from.
It corresponds to the [ID] column of the [Media] table.
ParentFileID
The globally unique identifier that is the parent of this file.
This corresponds to the [ID] column of the [File] table.
Attributes
The attributes of the file (such as ReadOnly).
RawEntropy
The Shannon's Raw Entropy value representing the roughness of the data contained in the file's contents.
OSLength
The number of bytes in the file's contents as reported by the operating system. This can be greater than the true length of the file if the file is a sparse file.
HashID
The hash of the file's contents. To retrieve contents, look this value up in the Hash column of the [Content] table.
Signature
The first 4 bytes of the file's contents. If the file is shorter than 4 bytes, zeroes are added as padding.
OriginID
Where this file came from. Normal, Deleted, Carved, etc.
It corresponds to the [ID] column of the [Origin] table.
It should contain one of these values.
ContentStatusID
The identifier of the content status.
This corresponds to the [ID] column of the [ContentStatus] table.
0 - Unknown, 1 - Original (present), 4 - eliminated by hash, 5 - duplicate eliminated.
It should contain one of these values.
Created
This is the date/time of when the file was created.
LastAccess
The date/time when this file was last accessed.
LastWrite
The date/time when bytes were last written to this file.
FilenameID
Links the name of this file to a record in the Filename table with this [ID] value.
It corresponds to the [ID] column of the [Filename] table.
FileTypeID
The type of the file.
This column corresponds to the [ID] column of the [FileType] table.
PhysicalDiskOffset
The offset from the beginning of the physical disk where the first byte of this file was located.
NumberOfChildren
This field is greater than zero if there are other records whose [ParentFileID] matches this record's [ID] field.
FullPathID
Links the full path of this file to a record in the [Filename] table with this [ID] value.
It corresponds to the [ID] column of the [Filename] table.
