Are there any docs on the file carving in 3 3 0 I haven t us

Question

Are there any docs on the file carving in 3 3 0 I haven t used file carving at all and am not quite sure where to start

Noah Talerman · Answer

Yes Link to docs on file carving <https github com fleetdm fleet blob master docs infrastructure file carving md>

benbass · Answer

Awesome thanks

benbass · Answer

I have carving working now but I have a question as to where on the fleet server does the carve get saved In the mysql db or on disk on the fleet server

zwass · Answer

The blocks are stored in the MySQL DB and purged after 24 hours

zwass · Answer

As of now it s expected that you will download the carve through fleetctl and store it somewhere I imagine we will add plugins to automatically save to S3 etc

benbass · Answer

Awesome I was more wondering about where I needed to make sure I had enough storage allotted either to the fleet server or the DB