What is the difference between querying live endpoint files and using ATC to surface SQLite database contents?

Querying live endpoint files shows what is present on disk right now, while ATC can surface structured data stored inside local SQLite databases and expose it as a virtual table. That distinction matters because some of the most useful evidence, such as download history or quarantine metadata, lives inside application databases rather than ordinary files. ATC turns that hidden history into something security tools can query directly.

Why the data source changes what you can see

Live endpoint file queries answer a narrow question: what files exist on disk at the moment you query them. ATC broadens that view by exposing structured application data stored in local sqlite database, so the analyst can inspect records that are not represented as ordinary files. That is why download history, quarantine metadata, and similar evidence can be visible through ATC even when a simple file sweep misses it.

The practical difference is not just format, it is visibility. A file query is bounded by filesystem semantics, while a SQLite-backed virtual table gives you a way to interrogate application state with the same kind of tooling you would use against a table, which is much better suited to evidence that applications keep in database form rather than as standalone artifacts.

What ATC adds for endpoint investigation

ATC is useful when the investigation depends on records embedded inside endpoint databases, especially where the application stores history, state, or metadata in SQLite rather than flat files. The point is not that ATC replaces file collection, but that it complements it by surfacing durable application evidence that would otherwise require database-specific parsing or manual extraction.

Use live file queries when you need a current snapshot of files, paths, and on-disk artifacts.
Use ATC when the evidence of interest is likely to live inside a local SQLite store, such as browser, security, or application history.
Expect ATC to be stronger for structured records, and file querying to be stronger for presence, timestamps, and raw file context.

That distinction matters most in triage and incident response, where investigators often need to combine both views to understand what is on disk now and what the application has already recorded about prior activity.

Risk and Threat Considerations

Security teams can miss important evidence if they assume endpoint artifacts only live as files. Adversaries and unwanted activity often leave the most useful traces inside application databases, where history, state, and metadata persist even after the visible file surface has changed.

Failure mechanism: Analysts rely on ordinary file enumeration and never inspect the SQLite-backed application store, so relevant records remain hidden behind database structure instead of appearing as standalone files.

Impact: Investigations may lose download history, quarantine details, or other timeline evidence, which weakens attribution, scope determination, and containment decisions.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	8 — Audit Log Management	SQLite history and quarantine records are audit-like endpoint evidence.
	7 — Continuous Vulnerability Management	Endpoint evidence collection supports timely detection of suspicious activity on hosts.
Recommendation — Collect and review application records that preserve investigative history. Inventory endpoint evidence sources and monitor them for investigation-relevant changes.
NIST CSF 2.0	DE.CM — Security Continuous Monitoring	The comparison is about how practitioners observe endpoint state and hidden records.
	DE.AE — Anomalies and Events	Structured endpoint records help identify unusual download or quarantine events.
Recommendation — Use continuous monitoring to detect activity recorded in endpoint data stores. Correlate endpoint events with stored application history to spot anomalies.
MITRE ATT&CK	T1217 — Browser Session Cookie	Endpoint/application data stores can expose sensitive session or history artifacts.
Recommendation — Hunt for sensitive artifacts retained in local application stores and histories.

Practitioner Guidance

What to verify: Confirm whether the endpoint product or application keeps its history in SQLite before deciding that a file query is sufficient. If the evidence is table-shaped, a filesystem-only view is usually incomplete.

Decision rule: If the question is “what exists on disk right now,” query files first; if the question is “what has this application recorded,” add ATC or an equivalent SQLite-aware method immediately.

Practitioner takeaway: Treat ATC as an evidence-access method for structured local state, not as a replacement for file collection, because the best endpoint answers often require both the filesystem snapshot and the database record.