https://github.com/osquery/osquery logo
Title
a

Andrew Zick

05/22/2023, 11:41 PM
What’s the difference between what setting
carver_disable_function: true
would disable, and what setting
disable_carver: true
would disable? Seems like
disable_carver
means “carver will not run” which makes sense to me, but I can’t quite figure out what the former is for 🙂 something like carves can exist but will not be run?
z

zwass

05/23/2023, 1:50 AM
It's disabling the use of the file carver as a SQL function. See "carver as a function"https://www.metalliccode.com/carving
a

Andrew Zick

05/23/2023, 2:11 AM
Ah, thank you! Sort of a tangent, but I was hoping to follow up with someone about why I don’t get any results when searching for “carve” in the osquery docs? https://osquery.readthedocs.io/en/latest/ You’re probably busy though 😓
s

seph

05/23/2023, 4:04 PM
Probably because no one wrote them. Certainly feels like an omission. If you, or anyone else, wants to take a pass at them… Those are generated from https://github.com/osquery/osquery/tree/master/docs