Collects and downloads a specific file from Windows host endpoints using a method that may bypass security or access restrictions and retrieve deleted files.
If the Inode parameter is not specified, this audit returns only the first match of a deleted file .
This audit was formerly known as the w32rawfile-acquisition audit.
This audit cannot be imported into a data acquisition script. See Audits That Cannot Be Imported on page 1.
Supported Platforms
Windows only
Input Parameters
The following input parameters are available for this audit.
Path
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | FilePath | Valid values are a full file path and file name. |
Required? | yes | This parameter is required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the absolute path of the directory containing the file to acquire. For example:
|
Filename
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | String | Valid values are a string of text. |
Required? | yes | This parameter is required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the name of the file to acquire. For example:
|
Inode
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Numeric | Valid values are numeric. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the inode of the file to return. If the inode is not specified and the |
Deleted
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether to acquire deleted files. |
Prevent Hibernation
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether to prevent the host endpoint from entering hibernation while this audit is executed. |