Hi! anybody with experience file carving on the Downloads directory? Seems like it has different permissions than other folders. Any tips on how to configure it properly?

If you have given full disk access to osquery, that should work

thanks @sharvil that’s what I did in the end 🙂

No sweat!

@Luis Gomez Downloads is protected by TCC now, so it isn't accessible except with FDA or specific folder permissions.

yes I solved it with FDA 🙂