What’s the difference between what setting `carver...
# general
What’s the difference between what setting
carver_disable_function: true
would disable, and what setting
disable_carver: true
would disable? Seems like
means “carver will not run” which makes sense to me, but I can’t quite figure out what the former is for 🙂 something like carves can exist but will not be run?
It's disabling the use of the file carver as a SQL function. See "carver as a function"https://www.metalliccode.com/carving
Ah, thank you! Sort of a tangent, but I was hoping to follow up with someone about why I don’t get any results when searching for “carve” in the osquery docs? https://osquery.readthedocs.io/en/latest/ You’re probably busy though 😓
Probably because no one wrote them. Certainly feels like an omission. If you, or anyone else, wants to take a pass at them… Those are generated from https://github.com/osquery/osquery/tree/master/docs
Finally got around to this documentation. It’s short and barebones since I don’t know anything about the actual code. But it’s something 😄 https://github.com/osquery/osquery/pull/8118