1

Shouldn’t it be possible to select a files in a folder and its subfolders with the query in OSQuery: SELECT path FROM file WHERE directory LIKE '/Users/%';

That returns no results at all. What is missing?

Mattias Baecklund
  • 11
  • 2

1 Answers1

1

You could achieve this with

SELECT path FROM file WHERE path LIKE '/Users/%%';

But be warned that this is going to do a traversal of the entire filesystem below /Users, so it's going to take a while to run and return a huge number of results.

Zach
  • 1,263
  • 11
  • 25
  • Resulted in no rows returned – Mattias Baecklund May 01 '21 at 16:05
  • 1
    This may be a TCC/PPPC issue, since the first directory it would try to enumerate in a clean home folder would be Desktop - for testing this with osqueryi, you'd want to make sure you've allowed Terminal (or iTerm/whatever app you use) Full Disk Access in System Preferences -> Security -> Privacy tab (all the way on the right). – Sacrilicious May 12 '21 at 02:39