This sounds like a #C01DXJL16D8 question, so I’d maybe route to there.
But… generally speaking, osquery doesn’t do disk writes. I’m not sure if fleet is shipping an extension that does, but that might be hard to test for directly.
I would, however, expect to be able to see that in other things. Mounts, perhaps. Or general system health