Merge pull request #161 from armtash/file_atime

add atime to returned file data

Author: armtash

README.md

@@ -148,6 +148,7 @@ Each line of the JSON file records 1 _piece of information_.  There are some com
 
 ##### File Records
 For records representing files there are a bunch of useful keys:
+* `atime`: The file accessed time.
 * `ctime`: The file creation time.
 * `mtime`: The file modified time.
 * `file_path`: The absolute path to the file.

osxcollector/osxcollector.py

@@ -289,12 +289,14 @@ def _get_file_info(file_path, log_xattr=False):
         dict with key ['md5', 'sha1', 'sha2', file_path', 'mtime', 'ctime']
     """
     md5_hash, sha1_hash, sha2_hash = '', '', ''
+    atime = ''
     mtime = ''
     ctime = ''
     extra_data_check = ''
     extra_data_found = False
 
     if os.path.isfile(file_path):
+        atime = _datetime_to_string(datetime.fromtimestamp(os.path.getatime(file_path)))
         mtime = _datetime_to_string(datetime.fromtimestamp(os.path.getmtime(file_path)))
         ctime = _datetime_to_string(datetime.fromtimestamp(os.path.getctime(file_path)))
         md5_hash, sha1_hash, sha2_hash = _hash_file(file_path)
@@ -315,6 +317,7 @@ def _get_file_info(file_path, log_xattr=False):
             'sha1': sha1_hash,
             'sha2': sha2_hash,
             'file_path': file_path,
+            'atime': atime,
             'mtime': mtime,
             'ctime': ctime,
             'extra_data_check': extra_data_check,