diff --git a/artifacts/definitions/Linux/Sys/Trash.yaml b/artifacts/definitions/Linux/Sys/Trash.yaml new file mode 100644 index 00000000000..9df26a0a2e6 --- /dev/null +++ b/artifacts/definitions/Linux/Sys/Trash.yaml @@ -0,0 +1,24 @@ +name: Linux.Sys.Trash +description: Find files in trash bin for all users +author: Whitney Champion (@shortxstack) +parameters: + - name: trashFiles + default: '.local/share/Trash/**/*' + description: Glob of trash bin files relative to a user's home directory. + +sources: + - precondition: | + SELECT OS From info() where OS = 'linux' + + query: | + LET trash = SELECT * from foreach( + row={ + SELECT Uid, User, Homedir from Artifact.Linux.Sys.Users() + }, + query={ + SELECT OSPath, Size, Mtime, Ctime, User, Uid + FROM glob(root=Homedir, globs=trashFiles) + }) + + SELECT * from foreach( + row=trash)