collection

Dec 28, 2020

Changes in this version

+ type Directory struct

+ Artifact string

+ Atime string

+ Ctime string

+ Errors []interface{}

+ ID string

+ Mtime string

+ Path string

+ Type string

+ func NewDirectory() *Directory

+ func (i *Directory) AddError(err string) *Directory

+ type File struct

+ Artifact string

+ Atime string

+ Attributes map[string]interface{}

+ Ctime string

+ Errors []interface{}

+ ExportPath string

+ Hashes map[string]interface{}

+ ID string

+ Mtime string

+ Name string

+ Origin map[string]interface{}

+ Size float64

+ Type string

+ func NewFile() *File

+ func (i *File) AddError(err string) *File

+ type Process struct

+ Artifact string

+ CommandLine string

+ CreatedTime string

+ Cwd string

+ Errors []interface{}

+ ID string

+ Name string

+ ReturnCode float64

+ StderrPath string

+ StdoutPath string

+ Type string

+ WMI []interface{}

+ func NewProcess() *Process

+ func (i *Process) AddError(err string) *Process

+ type RegistryKey struct

+ Artifact string

+ Errors []interface{}

+ ID string

+ Key string

+ ModifiedTime string

+ Type string

+ Values []RegistryValue

+ func NewRegistryKey() *RegistryKey

+ func (i *RegistryKey) AddError(err string) *RegistryKey

+ type RegistryValue struct

+ Data string

+ DataType string

+ Errors []interface{}

+ Name string

+ func NewRegistryValue() *RegistryValue

+ func (i *RegistryValue) AddError(err string) *RegistryValue

+ type Store interface

+ InsertStruct func(element interface{}) (string, error)

+ LoadFile func(filePath string) (file io.ReadCloser, teardown func() error, err error)

+ SetFS func(fs afero.Fs)

+ StoreFile func(filePath string) (storePath string, file io.WriteCloser, teardown func() error, err error)

Nov 1, 2020

Changes in this version

type LiveCollector

+ func (c *LiveCollector) Prefixes() []string

May 16, 2020

Changes in this version

type Configuration

+ FS afero.Fs

+ OutputDir string

+ type Resetter interface

+ Reset func()

Jan 29, 2020

Changes in this version

+ type LiveCollector struct

+ SourceFS fslib.FS

+ Store *goforensicstore.ForensicStore

+ TempDir string

+ func NewCollector(store *goforensicstore.ForensicStore, tempDir string, ...) (*LiveCollector, error)

+ func (c *LiveCollector) AddPartitions() bool

+ func (c *LiveCollector) Collect(name string, source goartifacts.Source)

+ func (c *LiveCollector) CollectCommand(name string, source goartifacts.Source) (process *goforensicstore.Process, err error)

+ func (c *LiveCollector) CollectDirectory(name string, source goartifacts.Source) (files []*goforensicstore.File, err error)

+ func (c *LiveCollector) CollectFile(name string, osource goartifacts.Source) (files []*goforensicstore.File, err error)

+ func (c *LiveCollector) CollectPath(name string, source goartifacts.Source) (directories []*goforensicstore.Directory, err error)

+ func (c *LiveCollector) CollectRegistryKey(name string, source goartifacts.Source) (keys []*goforensicstore.RegistryKey, err error)

+ func (c *LiveCollector) CollectRegistryValue(name string, source goartifacts.Source) (keys []*goforensicstore.RegistryKey, err error)

+ func (c *LiveCollector) CollectWMI(name string, source goartifacts.Source) (process *goforensicstore.Process, err error)

+ func (c *LiveCollector) FS() fslib.FS

+ func (c *LiveCollector) Registry() fslib.FS

+ func (c *LiveCollector) Resolve(parameter string) (resolves []string, err error)

Jan 3, 2020

Changes in this version

+ func Collect(tempDir string, source fslib.FS, store *goforensicstore.ForensicStore, ...)

+ func WMIQuery(q string) (wmiResult []map[string]interface{}, err error)

+ type Configuration struct

+ Artifacts []string

+ Case string

+ Type string

+ User bool