@MaxosxOsquery Can you be more specific? If you know the general location of the file you can use the

bsd_flags

column of the

file

table like so:

osquery> SELECT path, filename, bsd_flags FROM FILE WHERE path = '/Users/fritz-imac/Downloads/img02.jpg';
+---------------------------------------+-----------+--------------+
| path                                  | filename  | bsd_flags    |
+---------------------------------------+-----------+--------------+
| /Users/fritz-imac/Downloads/img02.jpg | img02.jpg | UF_IMMUTABLE |
+---------------------------------------+-----------+--------------+