Hello! I am a PM working at Elastic and I am doing some researching in Osquery and see how we can improve our integration. Not sure it this is the right channel but there are some forensics artifacts that would be useful from a DFIR perspective to be queried like: AmCache, Jumplists, LNK files, etc. We saw that there was an attempt to get amcache but got rejected https://github.com/osquery/osquery/pull/7261. Did anyone face this before and found a way or a workaround to query this data? We are willing to support and contribute to the community but we would like to understand what are the limitations, blockers, etc.

I see that the PR was closed referencing a Slack discussion here, but it’s not here (the Slack history). I found it here: https://chat.osquery.io/?threads%5Bquery%5D=amcache My understanding is that the approach in that PR did not implement a needed constraint for returned data (a

WHERE

clause in SQL), and it was not merged because it could have indeterminate runtime to query, without that.

This is great! Thank you so much @Mike M