@moulik it’s been a while but I believe there’s an I’d that’s past from the server to the client then back up to the server, as @clippy mentioned check out that issue, if you still can’t get it sorted hit me up and we can figure out what’s missing

@thor Thanks for your response. I could not fimd a way to relate carve uoload with distributed query. While initiating upload, I cannot see distributed query id in the request from osquery agent, which I can relate with the upload. It sends following things: 1. Carve guid 2. Carve size 3. Block count 4. Block size