CB Response: Cannot Delete Read-Only Files and Folders With Live Response

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• The 'delete' command inside of a Live Response session gives the following errors when attempting to remove files or directories:
  • "Remote error HRESULT 0x80070005" = 0x80070005: Facility[WIN32] Code[0005] Severity[1] Access is denied.

Environment

• CB Response Server: All Supported Versions

Cause

• Read-only flags are set on files and directories.  The error generated is being given by the OS, due to the files being read-only.

Resolution

• The easiest way to remove read-only files and folders is to use sdelete: https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete 
  • Download and extract the sdelete.exe/sdelete64.exe files to the local workstation from the link above.
  • Use the 'put' command in the Live Response session to send the sdelete executable to the sensor : 

put <destination_location>

• Change directories to the 'destination_location' above.

cd <destination_location>

• Run sdelete.exe command from Live Response.

execfg sdelete.exe /accepteula -r "<directory/file_to_delete>"

• Switches:
  • /accepteula : Accepts EULA without prompting via GUI
  • -r : Recurse subdirectories (if applicable)