Browse Live Discover and Response Queries by Category
Approved

NOTE: Answer in comments

Retrieve Folder Size

I know you can get data back from files but is there a way to modify the OSQuery to get folder or directory information. Wanter to get Desktop and Document size. and convert if possible to MB.

Connor Rosenthal

  • SELECT directory, SUM(CAST(ROUND((size * 10e-7),4) AS varchar)) AS SizeInMB FROM file WHERE directory = '$$directory$$'

    The above query will show the size of the directory 

    The output will look like this- 

    You can use the variable or you can directly put up the directory information in the query.

    Note: It will not check any nested directories and will not retrieve those directories' sizes but you can check with wildcards if they help.

    Regards,

    JR

Unfiltered HTML