Generally osquery does not allow file extraction like that. You can take a look at the file carving sections, though it’s often not enabled on endpoints.

Thanks, I will take a look to carving 😊