sudo osqueryi "select * from device_file where device = '/dev/disk0' and partition = 4 and filename like '%scap'"
+------------+-----------+-------------------------------------+---------------+--------+-----+-----+------+----------+------------+------------+------------+------------+------------+---------+
| device     | partition | path                                | filename      | inode  | uid | gid | mode | size     | block_size | atime      | mtime      | ctime      | hard_links | type    |
+------------+-----------+-------------------------------------+---------------+--------+-----+-----+------+----------+------------+------------+------------+------------+------------+---------+
| /dev/disk0 | 4         | /EFI/APPLE/EXTENSIONS/Firmware.scap | Firmware.scap | 427142 | 0   | 0   | 511  | 15729264 | 4096       | 1465369200 | 1467380922 | 1465422016 | 1          | regular |
+------------+-----------+-------------------------------------+---------------+--------+-----+-----+------+----------+------------+------------+------------+------------+------------+---------+