I personally would be using osqueryi in IR situations, can't speak for others. All I meant from the above, is that osquery doesn't necessarily make forensic guaruntees about timestamp modifications, or grabbing data in a forensically sound manner