Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

question about file carver:

`carver_disable_function` and `disable_carver` both default to true. What happens if you set one to false? What is the difference between the two flags?

heh, this was one I was wondering about recently :sweat_smile: let me see if I can dig up the thread

Ah, there's no thread but <https://github.com/fleetdm/fleet/blob/a7aa14fa7604b8ab503d326a10c7188ef6312e58/orbit/pkg/osquery/flags.go#L30-L32>

This "double-negative" `--disable-foo=false` is unfortunately common in osquery... IIRC it's due to something with the way that gflags (our flag parsing library) handles default values.