Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

<@U6DP73W4A> take a look at this. It may answer some questions. <https://github.com/mwielgoszewski/doorman/issues/120>

Thanks for the response. I could not find a way to relate distributed query id amd carve session id. While initiating upload, client doesn't send distributed query id

<@U6DP73W4A> it’s been a while but I believe there’s an I’d that’s past from the server to the client then back up to the server, as <@U2NMC13UJ> mentioned check out that issue, if you still can’t get it sorted hit me up and we can figure out what’s missing

<@U0JT049S4> Thanks for your response. I could not fimd a way to relate carve uoload with distributed query. While initiating upload, I cannot see distributed query id in the request  from osquery agent, which I can relate with the upload. It sends following things:
1. Carve guid
2. Carve size
3. Block count
4. Block size

<@U9JGGT91V> there’s some detail for it here <https://github.com/mwielgoszewski/doorman/issues/120>

turned our AV alerts into auto-carves to dump into an S3 bucket for our Sirt team.  They seemed to like that

Next implement <http://www.binaryalert.io/> to scan the S3!?? :slightly_smiling_face:

rofl!  already done :slightly_smiling_face:

which open source fleet management tool support file carving ??

<https://github.com/osquery/osquery/issues/3797> this Github PR shows that Zentral might have the capability

<https://www.metalliccode.com/carving/>

This blog post shows two flags `--carver_start_endpoint=/start_upload` (Where is the endpoint to tell the server we’re starting a carve) and `--carver_continue_endpoint=/upload_blocks` (Where is the endpoint to give the server a block of data).

You could build a simple Python flask app to handle receive files as well

anyone tried osquery with google GRR ??

i tried this -&gt; <https://github.com/google/grr-doc/blob/master/investigating-with-grr/osquery.md>

but no luck

Is there a specific error you’re encountering?

Hey y’all,

Just released a blog post for my open-source GoLang server that can be used by Osquery endpoints to upload file carves too.

Blog post: <https://holdmybeersecurity.com/2020/09/24/setup-my-golang-osquery-file-carving-server-with-kolide/>
Github: <https://github.com/CptOfEvilMinions/osquerey-file-carve-server>

Hello all - Does anyone here know if it is possible to export carve results off box in a way other than POSTing it?  Or maybe a way to set a `carve_plugin` like we can with logging and config??

Hey guys - anyone had success is carving locked files? For instance - carving the Amcache.hve pops a "SHARING_VIOLATION" (in procmon). Returns an empty file