and another question why does osquery carving adding metatadata to the object at the minio?

Hey @nick fury , it would be helpful if had a bit more information about the metadata you're referencing

when I pull the file that I have uploaded from the carving, for example with mc(minio client) it copies the file and adds 512 bytes at the beginning of the file that i think that are metadata.

Thinking that the mechanisms for the file carve are "splicing", "queuing", and then assembling the file parts together; there is some overhead and data added in the process. Isn't necessarily "direct copy". Believe the carving that osquery provides is a good impromptu method for investigation and then building more precise scheduled queries.