mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-08 10:23:54 +00:00
18 lines
789 B
Plaintext
18 lines
789 B
Plaintext
|
table_name("carves")
|
||
|
|
description("Forensic Memory Carves")
|
||
|
|
schema([
|
||
|
|
Column("time", BIGINT, "Time at which the carve was kicked off"),
|
||
|
|
Column("sha256", TEXT, "A SHA256 sum of the carved archive"),
|
||
|
|
Column("size", INTEGER, "Size of the carved archive"),
|
||
|
|
Column("path", TEXT, "The path of the requested carve"),
|
||
|
|
Column("status", TEXT, "Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED"),
|
||
|
|
Column("carve_guid", TEXT, "Identifying value of the carve session"),
|
||
|
|
Column("carve", INTEGER, "Set this value to '1' to start a file carve")
|
||
|
|
])
|
||
|
|
attributes(user_data=True)
|
||
|
|
implementation("forensic/carves@genCarves")
|
||
|
|
examples([
|
||
|
|
"select * from carves where status like '%FAIL%'",
|
||
|
|
"select * from carves where path like '/Users/%/Downloads/% and carve=1'",
|
||
|
|
])
|