Select all files in a folder and subfolders with OSQuery

2k views Asked by At

Shouldn’t it be possible to select a files in a folder and its subfolders with the query in OSQuery: SELECT path FROM file WHERE directory LIKE '/Users/%';

That returns no results at all. What is missing?

1

There are 1 answers

2
Zach On

You could achieve this with

SELECT path FROM file WHERE path LIKE '/Users/%%';

But be warned that this is going to do a traversal of the entire filesystem below /Users, so it's going to take a while to run and return a huge number of results.