multifile‑acquisition‑raw Audit

Collects multiple files from host endpoints based on filter criteria (such as path or filename) using a method that may bypass security or access restrictions and retrieve deleted files.

This audit was formerly known as the w32multifileraw-acquisition audit.

This audit cannot be imported into a data acquisition script. See Audits That Cannot Be Imported on page 1.

Supported Platforms

Windows only

Input Parameters

The following input parameters are available for this audit.

Path Parameter

Details	Values	Description
Platform	Windows	Windows environments
Format	FilePath	Valid values are a full file path and file name.
Required?	yes	This parameter is required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the absolute path of the directory containing the files to acquire. The trailing back-slash is optional. For example: `C:\\WINDOWS\\`

Path Regex Parameter

Details	Values	Description
Platform	Windows	Windows environments
Format	String	Valid values are a string of text.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the Perl-compatible regular expression a file must match to be collected. You must use standard regex expressions, including regex escaping techniques. (Specifying `'\\\\'` matches a single `'\\'` and specifying `'\\'` matches `'\'`.) The following example matches all files in any subdirectory: `.` The following example matches all the `.xls` files in any subdirectory: `.*\.xls` The files in a subdirectory named `Temp`, such as `C:\Windows\Temp\<filename>.xls` (note that backslashes must be escaped: `.\\Temp\\.\.xls`)

Depth Parameter

Details	Values	Description
Platform	Windows	Windows environments
Format	Numeric	Valid values are numeric.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the number of directory levels to include in the audit. Specifying `-1` represents full depth.

Minimum Sizes Parameter

Details	Values	Description
Platform	Windows	Windows environments
Format	ArrayOfString	Valid values are specified in an array of string values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the minimum file size, in bytes, of a file collected for this audit.

Maximum Sizes Parameter

Details	Values	Description
Platform	Windows	Windows environments
Format	ArrayOfString	Valid values are specified in an array of string values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the maximum file size, in bytes, of a file collected for this audit.

Active Files Parameter

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether the audit should enumerate the active files. Active files include all files except deleted files.

Deleted Files Parameter

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether the audit should enumerate the deleted files.

Filter MD5 Parameter

Details	Values	Description
Platform	Windows	Windows environments
Format	ArrayOfString	Valid values are specified in an array of string values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Filter the results based on a specific MD5 hash.

Filter SHA1 Parameter

Details	Values	Description
Platform	Windows	Windows environments
Format	ArrayOfString	Valid values are specified in an array of string values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Filter the results based on a specific SHA1 hash.

Filter SHA256 Parameter

Details	Values	Description
Platform	Windows	Windows environments
Format	ArrayOfString	Valid values are specified in an array of string values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Filter the results based on a specific SHA256 hash.

Content Regex Parameter

Details	Values	Description
Platform	Windows	Windows environments
Format	ArrayOfString	Valid values are specified in an array of string values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify a valid regex string for which to search.

AND Operator Parameter

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether the audit should collect a file only if its content matches all regex parameters.

Prevent Hibernation Parameter

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether to prevent the host endpoint from entering hibernation while this audit is executed.