outdir

Documentation

Overview

Package outdir names and creates the directory one collection writes into.

Every run gets its own directory, created exclusively. That is what makes concurrent collections safe: two runs cannot be handed the same destination even if they start in the same second, so there is no lock to take, no lock to go stale, and no way for one collection's output to be interleaved into another's.

It matters more than tidiness. The spool writers append in buffered chunks, and a flush boundary falls mid-line, so two processes appending to one bodyfile splice records from different images into each other -- with the right number of lines and no error, which is the worst way for evidence to be wrong. Unique directories remove the possibility rather than detecting it.

The naming follows UAC's own convention, uac-%hostname%-%os%-%timestamp%, so the output is recognisable to anyone who knows the tool.

Index

• Constants
• func Create(dest, base string) (string, error)
• func Hostname(mountPoint string) string
• func Name(hostname, targetOS string, now time.Time) string

Constants

const TimestampLayout = "20060102150405"

TimestampLayout is the 14-digit form UAC uses.

Functions

func Create

func Create(dest, base string) (string, error)

Create makes a uniquely named directory inside dest and returns its path.

base names the directory; an empty base uses Name. If that directory already exists -- a second run in the same second, or a repeated explicit name -- a counter is appended until one is created. os.Mkdir fails rather than succeeding on an existing directory, so the winner of a race is whichever process created it, and the loser moves on to the next name.

func Hostname

func Hostname(mountPoint string) string

Hostname reads the host name out of the image, falling back to the running system only when collecting from / itself.

Reading it from the image is what makes the output directory identify the evidence rather than the workstation that processed it.

func Name

func Name(hostname, targetOS string, now time.Time) string

Name builds the run directory name.