osctrl
osctrl copied to clipboard
Osctrl-tls has no options for file carves
root@osctrl:/home/superadmin# osctrl-admin --help
...
--carved value Directory for all the received carved files from osquery (default: "./carved_files/") [$CARVED_FILES]
--version, -v print the version (default: false)
osctrl-admin
has an option for where to retrieve carved files but osctrl-tls
does NOT have an option for where to write carved files.