Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

<@U09M563C7>: a 2015 Macbook Air running 10.10.5.
```+------------+-----------+-------------------------------------+---------------+-------+-----+-----+------+----------+------------+------------+------------+------------+------------+---------+
| device     | partition | path                                | filename      | inode | uid | gid | mode | size     | block_size | atime      | mtime      | ctime      | hard_links | type    |
+------------+-----------+-------------------------------------+---------------+-------+-----+-----+------+----------+------------+------------+------------+------------+------------+---------+
| /dev/disk0 | 4         | /EFI/APPLE/EXTENSIONS/Firmware.scap | Firmware.scap | 198   | 0   | 0   | 511  | 15729264 | 512        | 1437710400 | 1437753878 | 1437753879 | 1          | regular |
+------------+-----------+-------------------------------------+---------------+-------+-----+-----+------+----------+------------+------------+------------+------------+------------+---------+```