diff --git a/README.md b/README.md index 9cbb621..e3b9d93 100644 --- a/README.md +++ b/README.md @@ -148,6 +148,7 @@ Each line of the JSON file records 1 _piece of information_. There are some com ##### File Records For records representing files there are a bunch of useful keys: +* `atime`: The file accessed time. * `ctime`: The file creation time. * `mtime`: The file modified time. * `file_path`: The absolute path to the file. diff --git a/osxcollector/osxcollector.py b/osxcollector/osxcollector.py index a7600c6..c853850 100644 --- a/osxcollector/osxcollector.py +++ b/osxcollector/osxcollector.py @@ -289,12 +289,14 @@ def _get_file_info(file_path, log_xattr=False): dict with key ['md5', 'sha1', 'sha2', file_path', 'mtime', 'ctime'] """ md5_hash, sha1_hash, sha2_hash = '', '', '' + atime = '' mtime = '' ctime = '' extra_data_check = '' extra_data_found = False if os.path.isfile(file_path): + atime = _datetime_to_string(datetime.fromtimestamp(os.path.getatime(file_path))) mtime = _datetime_to_string(datetime.fromtimestamp(os.path.getmtime(file_path))) ctime = _datetime_to_string(datetime.fromtimestamp(os.path.getctime(file_path))) md5_hash, sha1_hash, sha2_hash = _hash_file(file_path) @@ -315,6 +317,7 @@ def _get_file_info(file_path, log_xattr=False): 'sha1': sha1_hash, 'sha2': sha2_hash, 'file_path': file_path, + 'atime': atime, 'mtime': mtime, 'ctime': ctime, 'extra_data_check': extra_data_check,