dumpers

Documentation

Index

• func CreateForensicsDirectory(directoryPath string) (bool, error)
• func MemoryDump(foresincDataDirectory string, pid int, verification int, ...) (bool, string, error)

Functions

func CreateForensicsDirectory

func CreateForensicsDirectory(directoryPath string) (bool, error)

CreateForensicsDirectory input: Path to direcctory to save forensic data If directory exists it skips, else create it. CreateForensicsDirectory output: Return boolean reult and on failure return error

func MemoryDump

func MemoryDump(foresincDataDirectory string, pid int, verification int, winAppDataDirPath string, dumpItExecutable *byteexec.Exec, procDumpExecutable *byteexec.Exec) (bool, string, error)

MemoryDump input: foresincDataDirectory, pid If PID is provided it will proceed with a memory dump of that process, else will default to a full memory dump MemoryDump output: Returns result, name of new dump (if sucessful), and status