GRAVE-ROBBER(1)

NAME
grave-robber - capture system forensic data

SYNOPSIS
grave-robber [ -Ddembs ] [ directory ]

DESCRIPTION
grave-robber processes a directory and all its subdirectories that it is given, gathering data. It runs many sub-programs in an attempt to capture information.

It roughly captures data according to the Order of Volatility; the OOV roughly says that certain data is more volatile or ephemeral than other types (memory vs. disk, for instance); generally speaking you want to capture the most volatile information before it goes away. However, since any queries of the system risk disturbing other potentially valuable data one must be careful. And while it impossible to automate this perfectly, the grave-robber can be a useful way of automating the process.

The results are saved in the directory $DATA (the value of which is found in the coroner.cf file), with each subprogram saving its output to a separate file.

OPTIONS

-D  debug - print lots of output. Usually not desired.

-d datadir
    Specify the data directory; this overrides the $DATA/hostname default.

-m  only output results for the mactime program - don't run other data collection programs.

-p  Capture pcat data; WARNING - some systems have significant trouble with this!

-q  quick scan: do not walk the filesystem, which can take up to several hours. This option is to be used when the disk will be copied (e.g., with dd(1)) and will be analyzed off-line.

-b bodyfile
    file to write to as the body, or mactime results file.

-e errorfile
    file to write stderr to.

-s stringsfile
    file to write to as the strings file.

grave-robber uses the configuration file coroner.cf, which is perl executable code, for most of its options and configuration details.

SEE ALSO
mactime(1)

LICENSE
Distributed under the details found in the COPYRIGHT file found in the root directory of The Coroner's Toolkit.

AUTHOR(S)
dan farmer
zen@fish.com
EarthLink Network, Inc.