Press CTRL+K to open search

TwinFiles collector

  • Published on Sep 3, 2026
  • 1 minute(s) read
Prev Next

The TwinFiles collector returns same file names and directories with different case from folders with case-sensitivity enabled on Windows 10.

Collector output

Field

Type

Description

name

String

The file name.

dir

String

The directory path where the file is located.

full_name

String

The fully qualified file name, including its path.

size

Number

File size in bytes.

last_write

Timestamp

The last time the operating system wrote the file.

md5

String

The file's content, in MD5 format.

sha1

String

The file's content, in SHA-1 format.

sha256

String

The file's content, in SHA-256 format.

created_at

Timestamp

Time stamp when the file was created.

deleted_at

Timestamp

Time stamp when the file was deleted.

status

String

Shows current for files that are currently on the file system, or deleted for files that were removed from the file system.

create_process_pid

Number

Process ID of the process that created the file.

create_process_sha256

String

SHA-256 hash of the process that created the file.

create_process_full_path

String

Full path of the process that created the file.

modify_process_pid

Number

Process ID of the process that modified the file.

modify_process_sha256

String

SHA-256 hash of the process that modified the file.

modify_process_full_path

String

Full path of the process that modified the file.

delete_process_pid

Number

Process ID of the process that deleted the file.

delete_process_sha256

String

SHA-256 hash of the process that deleted the file.

delete_process_full_path

String

Full path of the process that deleted the file.

create_user_domain

String

Domain name of the user executing the process that created the file.

create_user_name

String

Name of the user executing the process that created the file.

create_user_id

String

ID of the user executing the process that created the file.

modify_user_domain

String

Domain name of the user executing the process that modified the file.

modify_user_name

String

Name of the user executing the process that modified the file.

modify_user_id

String

ID of the user executing the process that modified the file.

delete_user_domain

String

Domain name of the user executing the process that deleted the file.

delete_user_name

String

Name of the user executing the process that deleted the file.

delete_user_id

String

ID of the user executing the process that deleted the file.



Supported versions

Windows

Linux

macOS

3.0 and later

NA

NA



Example: Show TwinFiles cmd.txt, Cmd.txt, and cMd.txt when searched with cmd.txt
HostInfo and TwinFiles full_name where HostInfo hostname contains "<endpoint_hostname>"
HostInfo and TwinFiles full_name where HostInfo hostname contains "<endpoint_hostname>" and TwinFiles full_name contains "<twin_file_name>"


Related articles
  • TwinFiles collector
    Endpoint Detection and Response with Forensics (EDRF) > Investigate potential threats with EDRF > Conduct searches > Search real-time data of endpoints for investigation and threat hunting > Collecting device data for real-time search > Built-in collectors
  • Files collector
    Endpoint Detection and Response (EDR) > Endpoint Detection and Response Product Guide > Collecting device data for real-time search > Built-in collectors
  • Files collector
    Endpoint Detection and Response with Forensics (EDRF) > Investigate potential threats with EDRF > Conduct searches > Search real-time data of endpoints for investigation and threat hunting > Collecting device data for real-time search > Built-in collectors