Channels
  • b

    benbass

    1 year ago
    Are there any docs on the file carving in 3.3.0? I haven’t used file carving at all and am not quite sure where to start.
  • Noah Talerman

    Noah Talerman

    1 year ago
  • b

    benbass

    1 year ago
    Awesome, thanks!
    I have carving working now, but I have a question as to where on the fleet server does the carve get saved? In the mysql db, or on disk on the fleet server?
  • zwass

    zwass

    1 year ago
    The blocks are stored in the MySQL DB and purged after 24 hours.
    As of now it's expected that you will download the carve through fleetctl and store it somewhere. I imagine we will add plugins to automatically save to S3, etc.