File carving functionality is broken

[javuto]

Issue

The file carving functionality in osctrl is broken past stable version 0.2.4. Last commit id with file carving fully working is 25b2b71b07dcfa81749b200b3fcc94a9138808eb.

Most likely the issue started happening after osquery/osquery#6959 landed in osquery, which was version 4.7.0. So any osquery version before that, should work as expected.

Mitigation

1. Using osquery stable 4.6.0 with osctrl should not be affected with latest code.
2. Using osctrl 0.2.4 or commit 25b2b71b07dcfa81749b200b3fcc94a9138808eb should work fine, given that osquery is not upgraded.

In order to checkout a specific tag or commit, use the following commands:

git checkout tags/0.2.4 0.2.4

git checkout 25b2b71b07dcfa81749b200b3fcc94a9138808eb