I'm sure people use Osqueryi for it as well. A very useful and portable tool for IR but probably not optimal as data could be tampered with or long gone by the time you get there.