EDR Sensor: What is the folder "C:\Windows\CarbonBlack\store" used for?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What is the folder "C:\Windows\CarbonBlack\store" used for?

Environment

• EDR (formerly CB Response) Sensor:  All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

• C:\Windows\CarbonBlack\store contains copies of binaries that have not yet been shared with the EDR server as well as a catalog of all observed binaries
• Any observed binary will be copied and stored in this location.
• Binaries will persist in the directory until the sensor checks in to the server.
  1. If the server does not have a copy of the binary, it is upload from the endpoint.
  2. If the server already has a copy of the binary, nothing is uploaded.
  3. Binary copies are then purged from the directory after check-in.