https://github.com/osquery/osquery logo
#carving
Title
# carving
a

Anoop K V

05/24/2021, 4:44 PM
I0524 173332.621054 10575 carver.cpp:186] Failed to post carve: No session_id received from remote endpoint
c

CptOfEvilMinions

06/23/2021, 7:45 PM
https://holdmybeersecurity.com/2020/09/24/setup-my-golang-osquery-file-carving-server-with-kolide/ In my blog post above I outline the file carve process. When Osquery inits a file server upload it contacts
/start_uploads
which should return a
session_id
. I'm not sure what file server your using but it may not be generating a
session_id
. To debug this you could generate CURL commands that act as an Osquery agent to see if a session_id is being generated.
16 Views