Documentation ¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Directory ¶ added in v0.1.1
type Directory struct { Artifact string `json:"artifact,omitempty"` Type string `json:"type"` Errors []string `json:"errors,omitempty"` Path string `json:"path"` Created *time.Time `json:"created,omitempty"` Modified *time.Time `json:"modified,omitempty"` Accessed *time.Time `json:"accessed,omitempty"` }
type File ¶ added in v0.1.1
type File struct { Artifact string `json:"artifact,omitempty"` Type string `json:"type"` Errors []string `json:"errors,omitempty"` Hashes map[string]string `json:"hashes,omitempty"` Size *int64 `json:"size,omitempty"` Name string `json:"name"` Created *time.Time `json:"created,omitempty"` Modified *time.Time `json:"modified,omitempty"` Accessed *time.Time `json:"accessed,omitempty"` Origin map[string]string `json:"origin,omitempty"` ExportPath string `json:"export_path,omitempty"` }
type Itemstore ¶
type Itemstore struct {
Items []interface{}
}
The Itemstore is a central storage for elements in digital forensic investigations. It stores any piece of information in the investigation and serves as a single source of truth for the data. Cases, artifacts, evidence, meta data, bookmarks etc. can be stored in the itemstore. Larger binary objects like files are usually stored outside the itemstore and references from the itemstore.
func (*Itemstore) AddItem ¶
func (store *Itemstore) AddItem(item interface{})
AddItem adds a single item to the itemstore
type Process ¶ added in v0.1.1
type Process struct { Artifact string `json:"artifact,omitempty"` Type string `json:"type"` Errors []string `json:"errors,omitempty"` Name string `json:"name,omitempty"` Created *time.Time `json:"created,omitempty"` Cwd string `json:"cwd,omitempty"` Arguments []string `json:"arguments,omitempty"` CommandLine string `json:"command_line,omitempty"` StdoutPath string `json:"stdout_path,omitempty"` StderrPath string `json:"stderr_path,omitempty"` }
type RegistryKey ¶ added in v0.1.1
type RegistryValue ¶ added in v0.1.1
Click to show internal directories.
Click to hide internal directories.