Are there any docs on the file carving in 3.3.0? ...
# fleetb
benbass
11/10/2020, 9:00 PMAre there any docs on the file carving in 3.3.0? I haven’t used file carving at all and am not quite sure where to start.
n
Noah Talerman
11/10/2020, 9:10 PMYes! Link to docs on file carving: https://github.com/fleetdm/fleet/blob/master/docs/infrastructure/file-carving.md
b
benbass
11/10/2020, 9:12 PMAwesome, thanks!
benbass
11/10/2020, 9:39 PMI have carving working now, but I have a question as to where on the fleet server does the carve get saved? In the mysql db, or on disk on the fleet server?
z
zwass
11/10/2020, 10:29 PM
The blocks are stored in the MySQL DB and purged after 24 hours.
zwass
11/10/2020, 10:29 PM
As of now it's expected that you will download the carve through fleetctl and store it somewhere. I imagine we will add plugins to automatically save to S3, etc.
b
benbass
11/10/2020, 11:39 PMAwesome, I was more wondering about where I needed to make sure I had enough storage allotted, either to the fleet server or the DB.
2 Views