Hello, I'm trying to understand how the FIM works on windows. How works the journal cache on windows? Are the files cached only at the start? Let's say I'm watching

C:\Users\vagrant\Documents\%

, and no file exists at the moment osquery starts. If I create a file named

test.txt

and a few minutes later I delete that file, Will I get an event? What if I also watch the folder and the folder exists previously? What if I also watch the folder and the folder does not exists previously?

@yossarian I know it has been a long time but would you recall answers to any of these questions?

the files should not be cached only at the start; the cache is continually updated based on events

@yossarian thank you!!!