CB Cloud: Live Response Remote error 0x80070003 - The system cannot find the path specified.

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Live Response into a Windows device connects to current directory C:\Windows\System32 and change directory three levels down although there are only two directories "Windows", and "System32" 

  Example:
  Live Response for device 20667640 
  [20667640] C:\WINDOWS\system32> cd ../../.. 
  [20667640] \>
  

• Attempting to change to any directory on the C drive will fail with "Remote error 0x80070003 - The system cannot find the path specified." 

  Example:
  [20667640] \> cd Windows Remote error 0x80070003 - The system cannot find the path specified.

Environment

• CB Cloud Console: All Versions
• CB Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

If change directory(cd) is used beyond the number of existing directories, then it is possible to exit the C drive

Example:
[20667640] \>

 

Resolution

Verify that the Live Response prompt is connected to the expected drive letter before changing to a directory within in the root of that drive letter

Example:
[20667640] \> cd C:\
[20667640] C:\> cd Windows
[20667640] C:\Windows\>