Entry

This page is generated from the code and must not be edited by hand.

One thing in the data pool, filesystem object or promoted derived stream.

Every platform-dependent field is nullable. Inode, device, mode, ownership and allocated size do not exist everywhere and are not comparable across filesystems; a schema that requires them is a schema that lies on some machine.

Access time is deliberately absent from this record’s fingerprint inputs. The engine reads files, and a fingerprint that includes access time would record the engine’s own reading as a change to the file.

Fields

Field	Type	Required	If left out
allocated_bytes	whole number or null	no	null
changed_ns	whole number or null	no	null
compound_extension	text	no	""
created_ns	whole number or null	no	null
created_time_source	TimeSource	no	"unavailable"
depth	whole number	no	0
derived_content_hash	text or null	no	null
device	whole number or null	no	null
entry_id	text	yes
entry_kind	EntryKind	no	"filesystem"
entry_type	EntryType	no	"file"
event_time_ns	whole number or null	no	null
event_time_source	TimeSource	no	"unavailable"
event_time_tier	ClockTier	no	"unavailable"
extension	text	no	""
extraction_profile	text or null	no	null
first_seen_run	text	yes
gid	whole number or null	no	null
inode	whole number or null	no	null
is_deleted	yes or no	no	false
last_seen_run	text	yes
locator_chain	list of LocatorStep	no	[]
mode	whole number or null	no	null
modified_ns	whole number or null	no	null
moved_at_ns	whole number or null	no	null
moved_by	MovedBy or null	no	null
moved_from	text or null	no	null
name	text	yes
nlink	whole number or null	no	null
ordinal	whole number or null	no	null
parent_entry_id	text or null	no	null
processing_fingerprint	text or null	no	null
relative_path	text	yes
resolution_status	ResolutionStatus	no	"unexamined"
root_id	text	yes
scan_outcome	ScanOutcome	no	"metadata_only"
schema_version	text	no	"1.23"
size_bytes	whole number or null	no	null
stat_fingerprint	text or null	no	null
symlink_state	SymlinkState	no	"not_a_link"
symlink_target	text or null	no	null
transformation	text or null	no	null
transformation_version	text or null	no	null
uid	whole number or null	no	null

The types named above are described on the shared types page: ClockTier, EntryKind, EntryType, LocatorStep, MovedBy, ResolutionStatus, ScanOutcome, SymlinkState, TimeSource.