<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Collecting Volatile Evidence — API Reference

## Memory Acquisition Tools

### AVML (Linux)

```bash
# Basic acquisition
avml /evidence/memory.lime

# Compressed output
avml --compress /evidence/memory.lime.gz
```

### LiME (Linux Kernel Module)

```bash
# Build for current kernel
cd LiME/src && make

# Acquire in lime format
insmod lime.ko "path=/evidence/memory.lime format=lime"

# Acquire in raw/padded format
insmod lime.ko "path=/evidence/memory.raw format=padded"
```

### winpmem (Windows)

```powershell
# Acquire raw memory image
winpmem_mini_x64.exe C:\Evidence\memory.raw

# Verify hash
certutil -hashfile C:\Evidence\memory.raw SHA256
```

## Network State Commands

### Linux

| Command | Purpose | Output |
|---------|---------|--------|
| `ss -tulnp` | All listening + established with PIDs | Connections + processes |
| `ss -tnp state established` | Established TCP only | Active connections |
| `ip neigh show` | ARP/neighbor table | MAC-to-IP mappings |
| `ip route show` | Routing table | Network routes |
| `iptables-save` | Firewall rules | All chains/rules |
| `cat /proc/net/tcp` | Raw TCP socket table | Hex-encoded connections |

### Windows

| Command | Purpose |
|---------|---------|
| `netstat -anob` | Connections with owning process |
| `Get-NetTCPConnection` | PowerShell TCP connections |
| `arp -a` | ARP cache |
| `route print` | Routing table |
| `netsh advfirewall show allprofiles` | Firewall state |

## Process Collection Commands

### Linux

```bash
# Full process tree
ps auxf

# Process details from /proc
ls -la /proc/[PID]/exe      # Binary path
cat /proc/[PID]/cmdline     # Command line (null-separated)
cat /proc/[PID]/environ     # Environment (null-separated)
ls -la /proc/[PID]/fd/      # Open file descriptors
cat /proc/[PID]/maps        # Memory mappings
cat /proc/[PID]/status      # Process status
```

### Windows

```powershell
Get-Process | Select-Object Id, ProcessName, Path, StartTime, CPU, WorkingSet64
Get-CimInstance Win32_Process | Select-Object ProcessId, Name, CommandLine, ParentProcessId
tasklist /V /FO CSV
wmic process list full
```

## Hashing and Integrity

```bash
# SHA-256 hash single file
sha256sum /evidence/memory.lime > /evidence/memory.lime.sha256

# Hash all evidence files
sha256sum /evidence/*.txt /evidence/*.lime > /evidence/manifest.sha256

# Verify manifest
sha256sum -c /evidence/manifest.sha256

# MD5 (legacy compatibility only — prefer SHA-256)
md5sum /evidence/memory.lime
```

## Common Patterns

### Full Linux Collection Script

```bash
#!/bin/bash
DIR="/evidence/$(date +%Y%m%d-%H%M%S)"
mkdir -p "$DIR"
ss -tulnp > "$DIR/netstat.txt"
ps auxf > "$DIR/procs.txt"
lsof -nP > "$DIR/openfiles.txt" 2>/dev/null
ip neigh > "$DIR/arp.txt"
w > "$DIR/users.txt"
lsmod > "$DIR/modules.txt"
sha256sum "$DIR"/* > "$DIR/manifest.sha256"
```

### Key Parameters

| Parameter | Description | Default |
|-----------|-------------|---------|
| `evidence_dir` | Base directory for evidence storage | `/evidence` |
| `format` | Memory image format (lime, raw, padded) | `lime` |
| `compress` | Enable compression for memory image | `false` |
| `hash_algo` | Hashing algorithm | `sha256` |
| `timeout` | Command execution timeout (seconds) | `30` |
