@thor the file carving is done by some other method, and then osquery is used to retrieve it? or can osquery actually designate what you want to carve?