Title
#general
t

Ted Dorosheff

01/31/2022, 8:55 PM
question about file carver:
carver_disable_function
and
disable_carver
both default to true. What happens if you set one to false? What is the difference between the two flags?
zwass

zwass

01/31/2022, 10:03 PM
heh, this was one I was wondering about recently 😅 let me see if I can dig up the thread
10:05 PM
This "double-negative"
--disable-foo=false
is unfortunately common in osquery... IIRC it's due to something with the way that gflags (our flag parsing library) handles default values.
t

Ted Dorosheff

01/31/2022, 10:30 PM
ahh okay thanks for clarifying