title: OSquery - How to preload data to find infected files
body: <p>I have to 'take over' some already infected windows workstations and servers during a cyber exercise.
  Plan is to setup eg. a clean windows 7 workstations with latest patches ... then update the infected workstation 7 to latest patches ... load osquery data (file checksums, file owner/group, permissions, etc.) and check the infected workstation against this know-good 'baseline'.
  is there a good way to do this with osquery or do your recommend another tool for this purpose?</p>