Windows 11 24H2 Files
Query ~2M file entries across 45+ Windows 11 24H2 cumulative updates (builds 26100.863 - 26100.7705+).
Database
Location: ~/moz_artifacts/win11_24h2_files.db
Schema:
files(kb_number, release_date, build, update_type, file_name, file_version, date, time, file_size)
Indexes: file_name , kb_number , build , file_version
Quick Start
Search for files
uv run ~/.claude/skills/win11-24h2-files/scripts/query.py search ntdll.dll
Version history for specific file
uv run ~/.claude/skills/win11-24h2-files/scripts/query.py history ntdll.dll
Compare two builds
uv run ~/.claude/skills/win11-24h2-files/scripts/query.py diff 26100.6584 26100.6899
List all patches
uv run ~/.claude/skills/win11-24h2-files/scripts/query.py builds
Database stats
uv run ~/.claude/skills/win11-24h2-files/scripts/query.py stats
Custom SQL
uv run ~/.claude/skills/win11-24h2-files/scripts/query.py sql "SELECT DISTINCT file_version FROM files WHERE file_name='kernel32.dll' ORDER BY build"
Commands
search
Find files by name pattern (case-insensitive contains match by default).
uv run ~/.claude/skills/win11-24h2-files/scripts/query.py search kernel # contains "kernel" uv run ~/.claude/skills/win11-24h2-files/scripts/query.py search kernel32.dll --exact # exact match uv run ~/.claude/skills/win11-24h2-files/scripts/query.py search .sys --limit 100
history
Track how a file's version changed across all patches. Shows * marker when version changed.
uv run ~/.claude/skills/win11-24h2-files/scripts/query.py history ntdll.dll uv run ~/.claude/skills/win11-24h2-files/scripts/query.py history tcpip.sys
diff
Compare file changes between two builds. Shows added, removed, and changed files.
uv run ~/.claude/skills/win11-24h2-files/scripts/query.py diff 26100.6584 26100.6899 uv run ~/.claude/skills/win11-24h2-files/scripts/query.py diff 26100.2894 26100.7705 --limit 20
builds
List all available patches with file counts.
uv run ~/.claude/skills/win11-24h2-files/scripts/query.py builds
sql
Run arbitrary SQL queries for complex analysis.
uv run ~/.claude/skills/win11-24h2-files/scripts/query.py sql "SELECT file_name, COUNT(DISTINCT file_version) as versions FROM files GROUP BY file_name ORDER BY versions DESC LIMIT 20"
Common Queries
Find files that changed most frequently:
uv run ~/.claude/skills/win11-24h2-files/scripts/query.py sql "SELECT file_name, COUNT(DISTINCT file_version) as ver_count FROM files GROUP BY file_name HAVING ver_count > 10 ORDER BY ver_count DESC LIMIT 30"
Find all kernel-mode drivers (.sys) in a specific build:
uv run ~/.claude/skills/win11-24h2-files/scripts/query.py sql "SELECT file_name, file_version FROM files WHERE build='26100.6584' AND file_name LIKE '%.sys' ORDER BY file_name"
Check if a specific file version exists:
uv run ~/.claude/skills/win11-24h2-files/scripts/query.py sql "SELECT kb_number, build, release_date FROM files WHERE file_name='ntoskrnl.exe' AND file_version='10.0.26100.6584'"