File Table

The [File] table holds the meta data information about a file.

SQL

CREATE TABLE "File"
(
  "ID" uuid NOT NULL,
  "MediaID" uuid NOT NULL,
  "ParentFileID" uuid NOT NULL,
  "Attributes" integer DEFAULT 0 NOT NULL,
  "RawEntropy" smallint DEFAULT 0 NOT NULL,
  "OSLength" bigint DEFAULT 0 NOT NULL,
  "HashID" uuid NOT NULL,
  "Signature" integer DEFAULT 0 NOT NULL,
  "OriginID" smallint DEFAULT 0 NOT NULL,
  "ContentStatusID" smallint DEFAULT 0 NOT NULL,
  "Created" timestamp without time zone NOT NULL,
  "LastAccess" timestamp without time zone NOT NULL,
  "LastWrite" timestamp without time zone NOT NULL,
  "FilenameID" bigint DEFAULT 0 NOT NULL,
  "FileTypeID" smallint DEFAULT 0 NOT NULL,
  "PhysicalDiskOffset" bigint DEFAULT 0 NOT NULL,
  "NumberOfChildren" integer DEFAULT 0 NOT NULL,
  "FullPathID" bigint DEFAULT 0 NOT NULL
);

Columns

ID

A globally unique identifier for this record.

MediaID

The globally unique identifier of the Media this file came from. It corresponds to the [ID] column of the [Media] table.

ParentFileID

The globally unique identifier that is the parent of this file. This corresponds to the [ID] column of the [File] table.

Attributes

The attributes of the file (such as ReadOnly).

RawEntropy

The Shannon's Raw Entropy value representing the roughness of the data contained in the file's contents.

OSLength

The number of bytes in the file's contents as reported by the operating system. This can be greater than the true length of the file if the file is a sparse file.

HashID

The hash of the file's contents. To retrieve contents, look this value up in the Hash column of the [Content] table.

Signature

The first 4 bytes of the file's contents. If the file is shorter than 4 bytes, zeroes are added as padding.

OriginID

Where this file came from. Normal, Deleted, Carved, etc. It corresponds to the [ID] column of the [Origin] table. It should contain one of these values.

ContentStatusID

The identifier of the content status. This corresponds to the [ID] column of the [ContentStatus] table. 0 - Unknown, 1 - Original (present), 4 - eliminated by hash, 5 - duplicate eliminated. It should contain one of these values.

Created

This is the date/time of when the file was created.

LastAccess

The date/time when this file was last accessed.

LastWrite

The date/time when bytes were last written to this file.

FilenameID

Links the name of this file to a record in the Filename table with this [ID] value. It corresponds to the [ID] column of the [Filename] table.

FileTypeID

The type of the file. This column corresponds to the [ID] column of the [FileType] table.

PhysicalDiskOffset

The offset from the beginning of the physical disk where the first byte of this file was located.

NumberOfChildren

This field is greater than zero if there are other records whose [ParentFileID] matches this record's [ID] field.

FullPathID

Links the full path of this file to a record in the [Filename] table with this [ID] value. It corresponds to the [ID] column of the [Filename] table.