file-carving
  • clippy

    clippy

    07/24/2018, 1:40 AM
    @moulik take a look at this. It may answer some questions. https://github.com/mwielgoszewski/doorman/issues/120
  • thor

    thor

    07/24/2018, 2:04 PM
    @moulik it’s been a while but I believe there’s an I’d that’s past from the server to the client then back up to the server, as @clippy mentioned check out that issue, if you still can’t get it sorted hit me up and we can figure out what’s missing
  • thor

    thor

    08/07/2018, 2:23 PM
    @nNipsx there’s some detail for it here https://github.com/mwielgoszewski/doorman/issues/120
  • clippy

    clippy

    01/22/2019, 10:21 PM
    turned our AV alerts into auto-carves to dump into an S3 bucket for our Sirt team. They seemed to like that
  • j

    joe_antony1

    02/17/2020, 2:44 PM
    which open source fleet management tool support file carving ??
  • j

    joe_antony1

    02/18/2020, 9:11 AM
    anyone tried osquery with google GRR ?? i tried this -> https://github.com/google/grr-doc/blob/master/investigating-with-grr/osquery.md but no luck
  • CptOfEvilMinions

    CptOfEvilMinions

    09/24/2020, 6:35 PM
    Hey y’all, Just released a blog post for my open-source GoLang server that can be used by Osquery endpoints to upload file carves too. Blog post: https://holdmybeersecurity.com/2020/09/24/setup-my-golang-osquery-file-carving-server-with-kolide/ Github: https://github.com/CptOfEvilMinions/osquerey-file-carve-server
  • Jordan

    Jordan

    06/28/2022, 7:57 PM
    Hello all - Does anyone here know if it is possible to export carve results off box in a way other than POSTing it? Or maybe a way to set a
    carve_plugin
    like we can with logging and config??
  • d

    Daniel

    10/19/2022, 10:31 PM
    Hey guys - anyone had success is carving locked files? For instance - carving the Amcache.hve pops a "SHARING_VIOLATION" (in procmon). Returns an empty file