Skip to content
Draft
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions articles/file-carving.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
# File carving

TODO

<meta name="articleTitle" value="File carving in Fleet">
<meta name="authorFullName" value="Noah Talerman">
<meta name="authorGitHubUsername" value="noahtalerman">
<meta name="publishedOn" value="2026-06-10">
<meta name="description" value="Learn how to TODO">
10 changes: 6 additions & 4 deletions docs/REST API/rest-api.md
Original file line number Diff line number Diff line change
Expand Up @@ -1311,13 +1311,15 @@ None.
- [Get carve](#get-carve)
- [Get carve block](#get-carve-block)

Fleet supports osquery's file carving functionality as of Fleet 3.3.0. This allows the Fleet server to request files (and sets of files) from Fleet's agent (fleetd), returning the full contents to Fleet.
> TODO: Warning on size of carve
Comment thread
noahtalerman marked this conversation as resolved.
Outdated

To initiate a file carve using the Fleet API, you can use the [live query](#run-live-query) endpoint to run a query against the `carves` table.
File carving allows you to request files (and sets of files) and their full contents.
Comment thread
noahtalerman marked this conversation as resolved.
Outdated

Keep in mind that any failure when uploading a file block (like a network error) will result on a failed carved file. Starting in osquery v5.22.1, block uploads will be retried up to three times before failing.
To initiate a file carve using the Fleet API, use the [live query](#run-live-query) endpoint to run a query against the `carves` table.
Comment thread
noahtalerman marked this conversation as resolved.
Outdated

For more information on executing a file carve in Fleet, go to the [File carving with Fleet docs](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/product-groups/orchestration/file-carving.md).
Any failure when uploading a file block (like a network error) will result on a failed carved file. Block uploads are retried up to three times before failing.

To learn more about executing a file carve in Fleet, head to the [file carving guide](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/product-groups/orchestration/file-carving.md).
Comment thread
noahtalerman marked this conversation as resolved.
Outdated

### List carves

Expand Down
Loading