What’s the difference between what setting

carver_disable_function: true

would disable, and what setting

disable_carver: true

would disable? Seems like

disable_carver

means “carver will not run” which makes sense to me, but I can’t quite figure out what the former is for 🙂 something like carves can exist but will not be run?

It's disabling the use of the file carver as a SQL function. See "carver as a function"https://www.metalliccode.com/carving

Ah, thank you! Sort of a tangent, but I was hoping to follow up with someone about why I don’t get any results when searching for “carve” in the osquery docs? https://osquery.readthedocs.io/en/latest/ You’re probably busy though 😓

Probably because no one wrote them. Certainly feels like an omission. If you, or anyone else, wants to take a pass at them… Those are generated from https://github.com/osquery/osquery/tree/master/docs

Finally got around to this documentation. It’s short and barebones since I don’t know anything about the actual code. But it’s something 😄 https://github.com/osquery/osquery/pull/8118