Skip to content
Permalink
Fetching contributors…
Cannot retrieve contributors at this time
391 lines (214 sloc) 16.1 KB

type: file

For each file in the file system, you can create a corresponding file object and inspect its properties. inspectors are also provided to look at version data of executable files.Note: File systems that do not maintain the creation or last accessed times will often return the last modification time when queried for the creation or last accessed times or files. Modification times are preserved when files are copied. Thus, it is not uncommon to see a file that appears to have been modified before it was created.

alias of <file> : boolean

Returns True if the file is an alias for another file.

aol error of <file> : string

No documentation exists.

aol error time of <file> : time

No documentation exists.

array of <file> : array

This inspector creates an OSXArray from the specified XML Data file.

byte <integer> of <file> : integer

Returns the numeric value of the byte located at the offset specified by number within the file. Byte 0 of the file is the first byte.Example: byte 0 of file "C:\test.txt" - Returns the first byte in the specified file.

content of <file> : file content

Returns an object that can be used to search for a string in the file.

creator of <file> : file signature

This refers to the four-character identifier used in all MacOS files. The creator tells what application should open the specified file.

data fork of <file> : datafork

Returns information about the data fork of the specified file.

dictionary of <file> : dictionary

Returns the dictionary object for the specified file.

drive of <file> : filesystem

Returns the drive associated with the specified file. On Macintosh computers, this returns a <volume> object.On *nix computers, this returns a <filesystem> object.

drive of <file> : volume

No documentation exists.

executable file format of <file> : string

Returns a four-byte string containing the format specifier for the specified file.Example: executable file format of client - Returns a string like "PE%00%00".

file version of <file> : version

Returns the file version extracted from the file's resource block. See version.

filesystem of <file> : filesystem

Returns the UNIX filesystem flag for the given file. On a Macintosh, this returns a <volume> object.

filesystem of <file> : volume

No documentation exists.

first raw version block of <file> : file version block

Returns the first version block directly from a PE file. If the first block is sufficient for your purposes, use this version inspector for best speed.

json of <file> : json value

Returns a JSON value for the content of the file.

{% qna %} Q: path "$.dependencies.express" of json of file "package.json" A: ^4.13.3 {% endqna %}

key <string> of <file> : string

Returns a key and its value from the given structured text file. It iterates over lines that start with the key name (as specified by <string>) followed by an = or : character. When searching, white space is ignored.

length of <file> : integer

The total length of the data and resource forks.Example: Length of data fork of file "Microsoft Word" of folder "Microsoft Office X" of Applications folder is greater than 100000 - Returns True if the data fork of the system file is greater than the specified amount.

line <integer> of <file> : file line

Returns the nth line (specified by <integer>) from the given file.

line containing <string> of <file> : file line

Returns all lines from the given file that contain the specified string.

line of <file> : file line

Iterates over all the lines of the specified file. Note that each line is truncated to 2048 bytes and the remaining characters are moved to the next line.

line starting with <string> of <file> : file line

Same as line <string> of <file>, returns the lines of the given file that start with the specified string.

locked content of <file> : file content

Returns an object that can be used to search for a string in the specified file that might be locked because it is concurrently opened for writing by another application.

You are supposed to use this inspector to access files that are only being appended to, such as log files, because the files can be changed while the inspector reads them. Otherwise the results can be unpredictable.

This inspector cannot read all kinds of locked files. It fails to open a file if another application has opened the file in an exclusive mode, that is, without allowing others to read the file.

The inspector does not override the access mode or the sharing flag specified to open the file by another application.

locked key <string> of <file> : string

Returns a key and its value from the given structured text file that might be locked because it is concurrently opened for writing by another application. It iterates over lines that start with the key name (as specified by <string>) followed by an = or : character. When searching, white space is ignored.

You are supposed to use this inspector to access files that are only being appended to, such as log files, because the files can be changed while the inspector reads them. Otherwise the results can be unpredictable.

This inspector cannot read all kinds of locked files. It fails to open a file if another application has opened the file in an exclusive mode, that is, without allowing others to read the file.

The inspector does not override the access mode or the sharing flag specified to open the file by another application.

locked line <integer> of <file> : file line

Returns the nth line (specified by <integer>) from the given file that might be locked because it is concurrently opened for writing by another application.

You are supposed to use this inspector to access files that are only being appended to, such as log files, because the files can be changed while the inspector reads them. Otherwise the results can be unpredictable.

This inspector cannot read all kinds of locked files. It fails to open a file if another application has opened the file in an exclusive mode, that is, without allowing others to read the file.

The inspector does not override the access mode or the sharing flag specified to open the file by another application.

locked line containing <string> of <file> : file line

Returns all the lines containing the specified string and belonging to the given file that might be locked because it is concurrently opened for writing by another application.

You are supposed to use this inspector to access files that are only being appended to, such as log files, because the files can be changed while the inspector reads them. Otherwise the results can be unpredictable.

This inspector cannot read all kinds of locked files. It fails to open a file if another application has opened the file in an exclusive mode, that is, without allowing others to read the file.

The inspector does not override the access mode or the sharing flag specified to open the file by another application.

locked line of <file> : file line

Iterates over all the lines of the specified file that might be locked because it is concurrently opened for writing by another application. Note that each line is truncated to 2048 bytes and the remaining characters are moved to the next line.

You are supposed to use this inspector to access files that are only being appended to, such as log files, because the files can be changed while the inspector reads them. Otherwise the results can be unpredictable.

This inspector cannot read all kinds of locked files. It fails to open a file if another application has opened the file in an exclusive mode, that is, without allowing others to read the file.

The inspector does not override the access mode or the sharing flag specified to open the file by another application.

locked line starting with <string> of <file> : file line

Same as line <string> of <file>, returns the lines starting with the specified string and belonging to the given file that might be locked because it is concurrently opened for writing by another application.

You are supposed to use this inspector to access files that are only being appended to, such as log files, because the files can be changed while the inspector reads them. Otherwise the results can be unpredictable.

This inspector cannot read all kinds of locked files. It fails to open a file if another application has opened the file in an exclusive mode, that is, without allowing others to read the file.

The inspector does not override the access mode or the sharing flag specified to open the file by another application.

locked of <file> : boolean

Returns True if the file is locked.Example: locked of file "this file" of folder "this folder" - Returns True if the specified file is locked.

locked section <string> of <file> : file section

Returns a named section of the specified file that might be locked because it is concurrently opened for writing by another application. It is useful for locating sections of 'ini' files. Section names are delimited by square bracket characters '[section name]'.

You are supposed to use this inspector to access files that are only being appended to, such as log files, because the files can be changed while the inspector reads them. Otherwise the results can be unpredictable.

This inspector cannot read all kinds of locked files. It fails to open a file if another application has opened the file in an exclusive mode, that is, without allowing others to read the file.

The inspector does not override the access mode or the sharing flag specified to open the file by another application.

md5 of <file> : string

Returns the md5 of the file. This inspector is not available in FIPS mode.

{% qna %} Q: md5 of file "/etc/passwd" A: 8a056052d5b944f5f2ffe3e93c8bd235 {% endqna %}

only raw version block of <file> : file version block

Returns the only version block directly from a PE file.

only version block of <file> : file version block

Most files only have 1 version block. This property allows language independent access when there is only one version block present. The result is the same as 'version block 1'.

pem encoded certificate of <file> : x509 certificate

Reads and returns the certificate from a file in the PEM format. This can be used to analyze encryption credentials on decrypting relays or root servers.

product version of <file> : version

Returns the product version extracted from the file's resource block. See version.

raw file version of <file> : version

Returns the file version directly from a PE file.

raw product version of <file> : version

Returns the product version directly from a PE file.

raw version block <integer> of <file> : file version block

Returns the numbered version block directly from a PE file.

raw version block <string> of <file> : file version block

Returns the named version block directly from a PE file.

raw version block of <file> : file version block

Returns the version block directly from a PE file.

raw version of <file> : version

Returns the version directly from a PE file.

resource fork of <file> : resfork

Returns information about the resource fork of the file.

section <string> of <file> : file section

Returns a named section of a file. Useful for locating sections of 'ini' files. Section names are delimited by square bracket characters '[section name]'.

security descriptor of <file> : security descriptor

Specifies the security descriptor associated with the specified file.

sha1 of <file> : string

Returns the sha1 of the file.

{% qna %} Q: sha1 of file "/etc/passwd" A: 4c62340ccf62b292ac66697ff8eb64aded4d957c {% endqna %}

sha224 of <file> : string

Returns the sha2-224 of the file.

{% qna %} Q: sha224 of file "/etc/passwd" A: d92e6a1ed28b714be2e6da94fbd0a89bf115110346289321deec0a8c {% endqna %}

sha256 of <file> : string

Returns the sha2-256 of the file.

{% qna %} Q: sha256 of file "/etc/passwd" A: da48b9f08e861546a980206889b7282fccda236f83a25e1b58de6fc5f1f361bd {% endqna %}

sha2_224 of <file> : string

Returns the sha2-224 of the file.

{% qna %} Q: sha2_224 of file "/etc/passwd" A: d92e6a1ed28b714be2e6da94fbd0a89bf115110346289321deec0a8c {% endqna %}

sha2_256 of <file> : string

Returns the sha2-256 of the file.

{% qna %} Q: sha2_256 of file "/etc/passwd" A: da48b9f08e861546a980206889b7282fccda236f83a25e1b58de6fc5f1f361bd {% endqna %}

sha2_384 of <file> : string

Returns the sha2-384 of the file.

{% qna %} Q: sha2_384 of file "/etc/passwd" A: 8bdadbaff533a5b10d2da7929783a76cc9d9ad9a53825aade38776dba07821996c96db90d20e7b6fb502ddd2462701d4 {% endqna %}

sha2_512 of <file> : string

Returns the sha2-512 of the file.

{% qna %} Q: sha2_512 of file "/etc/passwd" A: ed80a58904b3e73b4b70a11d387f5c18df016fe9c42c36c3f7b265a4e9304d7cd5f040900df25db971846167ba06cfc82c210dc2305c98dab76b09b08f7d6f1f {% endqna %}

sha384 of <file> : string

Returns the sha2-384 of the file.

{% qna %} Q: sha384 of file "/etc/passwd" A: 8bdadbaff533a5b10d2da7929783a76cc9d9ad9a53825aade38776dba07821996c96db90d20e7b6fb502ddd2462701d4 {% endqna %}

sha512 of <file> : string

Returns the sha2-512 of the file.

{% qna %} Q: sha512 of file "/etc/passwd" A: ed80a58904b3e73b4b70a11d387f5c18df016fe9c42c36c3f7b265a4e9304d7cd5f040900df25db971846167ba06cfc82c210dc2305c98dab76b09b08f7d6f1f {% endqna %}

shortcut of <file> : file shortcut

Returns the properties and locates the target of a file shortcut:pathname (string)start in pathname (string)argument string (string)icon pathname (string)icon index (integer).

size of <file> : integer

Returns the size in bytes of a file.

sqlite database of <file> : sqlite database

Opens the file as a sqlite database. This is a read-only SQLite connection. If the connection is successful, the path name of the database is displayed.

Multiple Processes and Multiple Connections

SQLite allows multiple processes to have the database file open at once, and for multiple processes to read the database at once. However, when any process wants to write, it must lock the entire database file for the duration of its update (usually a few milliseconds).

{% qna %} Q: rows of statement "select count(*) from Artist" of sqlite database of file "chinook.db" A: 275 {% endqna %}

stationery of <file> : boolean

Returns True if the file is a stationery file.

type of <file> : file type

This refers to the four-character identifier used in all MacOS files. The type describes the sort of file it is.

variable of <file> : string

Returns the names of variables contained in an INF style file, in the format [section].name=value.

version <integer> of <file> : version

Returns the nth version information from the "vers" resource of the given file. Typically n=1, but other information may be stored in "vers" resources greater than 1.

version block <integer> of <file> : file version block

You can identify the particular version block you want to access by ordinal number.

version block <string> of <file> : file version block

You can identify the particular version block you are looking up by name. The name you provide should match the id string of the version block.

version block of <file> : file version block

Iterates through the version blocks of a file.

version of <file> : version

Synonym for file version of <file>.

visible of <file> : boolean

Returns True if the file is visible.

volume of <file> : volume

The volume containing the file.

windows checksum of <file> : integer

No documentation exists.

xml document of <file> : xml dom document

Returns an XML Document Object Model (DOM) for the specified file.

<file> as string : string

Creates a string containing the full pathname of the specified file. See <file>.

You can’t perform that action at this time.