<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Automated Forensic Collection — API Reference

## AVML (Acquire Volatile Memory for Linux)

```bash
# Acquire memory dump
sudo avml /evidence/INC-001/memory.lime

# Acquire with compression
sudo avml --compress /evidence/INC-001/memory.lime.zst
```

## LiME (Linux Memory Extractor)

```bash
# Load kernel module for memory acquisition
sudo insmod lime.ko "path=/evidence/memory.lime format=lime"
```

## Volatile Data Collection Scripts

```bash
# Network state
ss -tunapl > /evidence/network_connections.txt
ip route show > /evidence/routing_table.txt
ip neigh show > /evidence/arp_cache.txt

# Process state
ps auxf > /evidence/processes.txt
lsof -nP > /evidence/open_files.txt 2>/dev/null

# System state
who -a > /evidence/logged_users.txt
last -20 > /evidence/recent_logins.txt
```

## Disk Imaging

```bash
# Raw disk image with hash
sudo dd if=/dev/sda bs=4M status=progress | \
  tee /evidence/disk.raw | sha256sum > /evidence/disk.raw.sha256

# Using dc3dd for forensic imaging
sudo dc3dd if=/dev/sda of=/evidence/disk.raw hash=sha256 log=imaging.log
```

## Evidence Integrity

```python
import hashlib

def hash_evidence(path: str) -> str:
    sha256 = hashlib.sha256()
    with open(path, "rb") as f:
        for chunk in iter(lambda: f.read(8192), b""):
            sha256.update(chunk)
    return sha256.hexdigest()
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Collection completed with verified integrity |
| 1 | Partial collection — some artifacts unavailable |
| 2 | Collection failure — evidence may be incomplete |
