<!--
{
  "availability" : [
    "macCatalyst: -",
    "macOS: -"
  ],
  "documentType" : "symbol",
  "framework" : "EndpointSecurity",
  "identifier" : "/documentation/EndpointSecurity/es_event_copyfile_t",
  "metadataVersion" : "0.1.0",
  "role" : "Structure",
  "symbol" : {
    "kind" : "Structure",
    "modules" : [
      "Endpoint Security"
    ],
    "preciseIdentifier" : "c:@SA@es_event_copyfile_t"
  },
  "title" : "es_event_copyfile_t"
}
-->

# es_event_copyfile_t

A type for an event that indicates the copying of a file by use of a system call.

```
struct es_event_copyfile_t
```

## Overview

Be aware that the `copyfile` system call isn’t the same thing as the `copyfile(3)` function in the standard library. Its semantics depend on the specific filesystem in use.

## Topics

### Inspecting Event Properties

[`source`](/documentation/EndpointSecurity/es_event_copyfile_t/source)

The file to clone.

[`target_file`](/documentation/EndpointSecurity/es_event_copyfile_t/target_file)

The file, if any, that exists at the target location.

[`target_dir`](/documentation/EndpointSecurity/es_event_copyfile_t/target_dir)

The directory that contains the copied file.

[`target_name`](/documentation/EndpointSecurity/es_event_copyfile_t/target_name)

The name of the newly copied file.

[`mode`](/documentation/EndpointSecurity/es_event_copyfile_t/mode)

The mode argument of the system call.

[`flags`](/documentation/EndpointSecurity/es_event_copyfile_t/flags)

The flags argument of the system call.

[`reserved`](/documentation/EndpointSecurity/es_event_copyfile_t/reserved)

An unused field reserved for future use.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)