mac_get_extended_attributes
Retrieve extended attributes from files to obtain accurate download times, quarantine information, and user-action dates for forensic analysis.
Instructions
Get extended attributes (xattr) for a file. Contains true download times, quarantine info, and user-action dates more accurate than DB records.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max files to return (for directory scans) | |
| file_path | Yes | Path to file or directory to scan | |
| recursive | No | Scan directory recursively |