surveilr_osquery_ms_carved_extracted_file
| Column |
Type |
PK |
Required |
Default |
| surveilr_osquery_ms_carved_extracted_file_id |
VARCHAR |
Yes |
Yes |
|
| carve_guid |
TEXT |
No |
Yes |
|
| path |
TEXT |
No |
Yes |
|
| size_bytes |
INTEGER |
No |
Yes |
|
| content_digest |
TEXT |
No |
Yes |
|
| nature |
TEXT |
No |
No |
|
| extracted_at |
TIMESTAMPTZ |
No |
Yes |
|
| created_at |
TIMESTAMPTZ |
No |
No |
CURRENT_TIMESTAMP |
| created_by |
TEXT |
No |
No |
'UNKNOWN' |
| updated_at |
TIMESTAMPTZ |
No |
No |
|
| updated_by |
TEXT |
No |
No |
|
| deleted_at |
TIMESTAMPTZ |
No |
No |
|
| deleted_by |
TEXT |
No |
No |
|
| activity_log |
TEXT |
No |
No |
|
Foreign Keys
| Column Name |
Foreign Key |
| carve_guid |
carve_guid references surveilr_osquery_ms_carve.carve_guid |
Indexes
| Column Name |
Index Name |
| path |
idx_surveilr_osquery_ms_carved_extracted_file__path__carve_guid |
| carve_guid |
idx_surveilr_osquery_ms_carved_extracted_file__path__carve_guid |
| surveilr_osquery_ms_carved_extracted_file_id |
sqlite_autoindex_surveilr_osquery_ms_carved_extracted_file_1 |
SQL DDL
CREATE TABLE "surveilr_osquery_ms_carved_extracted_file" (
"surveilr_osquery_ms_carved_extracted_file_id" VARCHAR PRIMARY KEY NOT NULL,
"carve_guid" TEXT NOT NULL,
"path" TEXT NOT NULL,
"size_bytes" INTEGER NOT NULL,
"content_digest" TEXT NOT NULL,
"nature" TEXT,
"extracted_at" TIMESTAMPTZ NOT NULL,
"created_at" TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
"created_by" TEXT DEFAULT 'UNKNOWN',
"updated_at" TIMESTAMPTZ,
"updated_by" TEXT,
"deleted_at" TIMESTAMPTZ,
"deleted_by" TEXT,
"activity_log" TEXT,
FOREIGN KEY("carve_guid") REFERENCES "surveilr_osquery_ms_carve"("carve_guid")
)