live

Documentation

Overview

Package live acquires volatile evidence in RFC 3227 order of volatility (plan §6): clock state first, then logged-in users, running processes, and network state.

Method disclosure: live acquisition runs OS-supplied utilities (ps, who, netstat, …). On a compromised host these can be trojaned; every record therefore carries collection_method "live_command" plus the exact command line, so analysts can weigh the evidence accordingly. Agent processes are never terminated or signaled.

Index

• type Stats
  • func Collect(b *casepkg.Builder, host, user string) (*Stats, error)

Types

type Stats

type Stats struct {
	Collected int
	Failed    int
}

Stats summarizes a live acquisition pass.

func Collect

func Collect(b *casepkg.Builder, host, user string) (*Stats, error)

Collect runs all volatile steps and ingests output into the builder.