Create Linux.Forensics.BodyFile.yaml #928
Conversation
|
@scudette any issues remaining? |
|
|
||
| -- Use foreach to iterate over the directories and run find recursively | ||
| LET RecurseFiles = SELECT Stdout FROM foreach(row=FilePaths, query={ | ||
| SELECT * FROM execve(argv=["find", str(OSPath), "-maxdepth", MaxRecursionDepth]) |
There was a problem hiding this comment.
There is probably no point shelling out to find - glob is quite capable of doing this.
Can you please explain how this is different from the usual file finder?
There was a problem hiding this comment.
Understood. I had difficulties getting a recursion parameter to work correctly using other methods. While not ideal to call out to find, I found this method to work quickly and effectively. Open to your advice.
There was a problem hiding this comment.
Take a look at the file finder https://docs.velociraptor.app/artifact_references/pages/linux.search.filefinder/ which does pretty much what this artifact is supposed to do - to get recursion use the double star glob ** as described here https://docs.velociraptor.app/docs/forensic/filesystem/
There was a problem hiding this comment.
Thanks for the reference. I will take a look at the adjustment as time permits.
No description provided.