looks like osquery can scan one or more sources (no idea how it is configured), carve the results into a temporary directory