When you query `SELECT * FROM file WHERE path like...
# macos
c
When you query
SELECT * FROM file WHERE path like '/Users/<user>/%
it ONLY shows files and directories that do not have a name that is prepended with a
.
. Is this behavior expected or unexpected? If this is expected behavior is it possible to get all files including ones prepended with a
.
? I tested on two macOS machines running Catalina with osquery versions 4.1.1 and 3.3.2.