Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
carves
carves
List the set of completed and in-progress carves. If carve=1 then the query is treated as a new carve request.
| Column | Type | Description |
|---|---|---|
| carve | integer | Set this value to '1' to start a file carve |
| carve_guid | text | Identifying value of the carve session |
| path | text | The path of the requested carve |
| request_id | text | Identifying value of the carve request (e.g., scheduled query name, distributed request, etc) |
| sha256 | text | A SHA256 sum of the carved archive |
| size | integer | Size of the carved archive |
| status | text | Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED |
| time | bigint | Time at which the carve was kicked off |
Example
select * from carves where path like '/Users/%/Downloads/%' and carve=1
Edit page
Ask us anything
Questions?
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
