<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Implementing Ransomware Incident Documentation — API Reference

## Evidence Hashing

```bash
# SHA-256 hash of evidence file
sha256sum /evidence/memory.dmp

# MD5 + SHA1 + SHA256 (belt and suspenders)
md5sum /evidence/disk.dd
sha1sum /evidence/disk.dd
sha256sum /evidence/disk.dd

# Verify evidence integrity
sha256sum -c evidence_hashes.txt
```

## Git for Documentation Version Control

```bash
# Initialize IR documentation repo
git init /evidence/INC-2026/docs
git add -A && git commit -m "Initial evidence catalog"

# Track all changes with timestamps
git log --oneline --all --graph
```

## pandoc Report Generation

```bash
# Markdown to PDF
pandoc ir_report.md -o ir_report.pdf --pdf-engine=xelatex

# Markdown to HTML
pandoc ir_report.md -o ir_report.html --standalone

# With table of contents
pandoc ir_report.md -o ir_report.pdf --toc --toc-depth=3
```

## exiftool Metadata Extraction

```bash
# Extract all metadata from evidence files
exiftool /evidence/*.pdf /evidence/*.docx

# Extract creation/modification timestamps
exiftool -CreateDate -ModifyDate -FileModifyDate /evidence/*
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `file` | Evidence file to catalog | `/evidence/memory.dmp` |
| `collector` | Person who collected evidence | `analyst1` |
| `timestamp` | Event timestamp | `2026-01-15T14:30:00Z` |
| `mitre_id` | MITRE ATT&CK technique | `T1486` |
