fritz
08/23/2020, 3:38 PMextended_attributes
table to look for where_froms
dataMaxosxOsquery
08/23/2020, 8:16 PMMike Myers
08/25/2020, 5:46 PMosquery> select * from extended_attributes WHERE path="/Users/mmyers/Downloads/developerID_application.cer" AND key="quarantine_agent";
+-----------------------------------------------------+-------------------------+------------------+--------+--------+
| path | directory | key | value | base64 |
+-----------------------------------------------------+-------------------------+------------------+--------+--------+
| /Users/mmyers/Downloads/developerID_application.cer | /Users/mmyers/Downloads | quarantine_agent | Safari | 0 |
+-----------------------------------------------------+-------------------------+------------------+--------+--------+
Magneto
08/25/2020, 5:49 PMfritz
08/25/2020, 6:29 PMMagneto
08/25/2020, 6:29 PM