I mean just outright retrieval. Pulling back malware for instance. Seems carving is a bit of a WIP https://github.com/facebook/osquery/issues/3797