System.VFS.ListDirectory

This is an internal artifact used by the GUI to populate the VFS. You may run it manually if you like, but typically it is launched by the GUI when a user clicks the “Refresh this directory” button.

name: System.VFS.ListDirectory
description: |
  This is an internal artifact used by the GUI to populate the
  VFS. You may run it manually if you like, but typically it is
  launched by the GUI when a user clicks the "Refresh this directory"
  button.

parameters:
  - name: Path
    description: The path of the file to download.
    default: "/"

  - name: Components
    type: json_array
    description: Alternatively, this is an explicit list of components.

  - name: Accessor
    default: file

  - name: Depth
    type: int
    default: 0

export: |
      -- Make the generator unique with the session id - so it can
      -- only be shared by the two sources in this collection.
      LET VFSGenerator = generate(name="vfs-" + _SessionId, query={
         SELECT * FROM vfs_ls(
            path="/", components=Components,
            accessor=Accessor, depth=Depth)
      }, delay=500)  -- wait a while for both sources to connect.

sources:
  - precondition: SELECT * FROM info() WHERE version(plugin="vfs_ls") = 1
    name: Listing
    description: File listing of multiple directories in a single table.
    query: |
      SELECT OSPath AS _OSPath,
             Components AS _Components,
             Accessor AS _Accessor,
             Data AS _Data,
             Name, Size, Mode,
             Mtime as mtime,
             Atime as atime,
             Ctime as ctime,
             Btime as btime,
             Idx AS _Idx
      FROM VFSGenerator
      WHERE Stats = NULL

  - precondition: SELECT * FROM info() WHERE version(plugin="vfs_ls") = 1
    name: Stats
    description: |
      A list of summary objects dividing the Listing source into
      distinct directories.
    query: |
      SELECT Components,
             Accessor,
             Stats
      FROM VFSGenerator
      WHERE Stats != NULL

  - precondition: SELECT * FROM info() WHERE NOT version(plugin="vfs_ls")
    query: |
      // Glob > v2 accepts a component list for the root parameter.
      LET Path <= if(condition=version(plugin="glob") > 2 AND Components,
        then=Components, else=Path)

      // Old versions do not have the root parameter to glob()
      // Fixes https://github.com/Velocidex/velociraptor/issues/322
      LET LegacyQuery = SELECT OSPath as _OSPath,
           Accessor as _Accessor,
           Data as _Data,
           Name, Size, Mode.String AS Mode,
           Mtime as mtime,
           Atime as atime,
           Ctime as ctime
        FROM glob(globs=Path + if(condition=Depth,
             then=format(format='/**%v', args=Depth), else='/*'),
             accessor=Accessor)

      LET NewQuery = SELECT OSPath as _OSPath,
           Accessor as _Accessor,
           Data as _Data,
           Name, Size, Mode.String AS Mode,
           Mtime as mtime,
           Atime as atime,
           Ctime as ctime,
           Btime AS btime
        FROM glob(
             globs=if(condition=Depth,
                then=format(format='/**%v', args=Depth),
                else='/*'),
             root=Path,
             accessor=Accessor)

      SELECT * FROM if(
       condition=version(plugin="glob") >= 1,
       then=NewQuery,
       else=LegacyQuery)