Title
#file-carving
thor

thor

07/24/2018, 2:04 PM
@moulik it’s been a while but I believe there’s an I’d that’s past from the server to the client then back up to the server, as @clippy mentioned check out that issue, if you still can’t get it sorted hit me up and we can figure out what’s missing
m

moulik

07/24/2018, 4:13 PM
@thor Thanks for your response. I could not fimd a way to relate carve uoload with distributed query. While initiating upload, I cannot see distributed query id in the request from osquery agent, which I can relate with the upload. It sends following things:1. Carve guid 2. Carve size 3. Block count 4. Block size