@the_drow no idea how it works in the osquery implementation, but data carving is just scanning a source (could be a file, or a block device)