Forensics Acquire

---
name: forensics-acquire
description: Evidence acquisition with chain of custody and hash verification
agent: acquisition-agent
category: forensics-acquisition
argument-hint: "<target> [--logs] [--config] [--memory] [--disk] [--all]"
---

# /forensics-acquire

Collect and preserve forensic evidence from the target system with complete chain of custody documentation and SHA-256 hash verification. Supports selective acquisition of logs, configuration files, memory images, and disk artifacts.

## Usage

`/forensics-acquire <target> [options]`

## Arguments

| Argument | Required | Description |
|----------|----------|-------------|
| target | Yes | SSH connection string (`ssh://user@host:port`) |
| --logs | No | Acquire system and application logs |
| --config | No | Acquire configuration files (SSH, cron, systemd, PAM) |
| --memory | No | Acquire memory image via `/proc/kcore` or LiME |
| --disk | No | Acquire disk image or filesystem artifacts |
| --all | No | Acquire all evidence types |
| --since | No | Acquire logs since timestamp (e.g., `2026-02-27T00:00:00Z`) |
| --output | No | Output directory (default: `.aiwg/forensics/acquisition/`) |
| --cloud | No | Acquire cloud evidence (EBS snapshots, CloudTrail, Activity Logs, Audit Logs) |
| --container | No | Acquire container evidence (logs, filesystem exports, inspect data) |
| --compress | No | Compress evidence archives with gzip |
| --no-verify | No | Skip post-acquisition hash verification (not recommended) |

## Behavior

When invoked, this command:

1. **Initialize Chain of Custody**
   - Generate unique evidence case ID (`EVD-<date>-<seq>`)
   - Record investigator identity, start timestamp, and collection method
   - Create custody log entry for each artifact

2. **Log Acquisition** (when `--logs` specified)
   - Collect authentication logs: `/var/log/auth.log`, `/var/log/secure`
   - Collect system logs: `/var/log/syslog`, `/var/log/messages`
   - Collect journal entries: `journalctl` full export
   - Collect application logs: nginx, apache, mysql, postfix (auto-detected)
   - Collect audit logs: `/var/log/audit/audit.log`
   - Filter by `--since` timestamp if provided
   - Compute SHA-256 for each collected file

3. **Configuration Acquisition** (when `--config` specified)
   - SSH daemon config: `/etc/ssh/sshd_config` and `sshd_config.d/`
   - Authorized keys: all user `.ssh/authorized_keys` files
   - Cron configurations: `/etc/cron*`, `/var/spool/cron/`
   - Systemd units: `/etc/systemd/system/`, `/usr/lib/systemd/system/` (recently modified)
   - PAM configuration: `/etc/pam.d/`
   - Sudoers: `/etc/sudoers`, `/etc/sudoers.d/`
   - Shell profiles: `.bashrc`, `.profile`, `.bash_profile` for all users

4. **Memory Acquisition** (when `--memory` specified)
   - Attempt acquisition via `/proc/kcore` (limited)
   - Check for LiME kernel module availability
   - If LiME available: load module, acquire to network socket or file
   - Record memory size and acquisition duration
   - Compute SHA-256 of memory image

5. **Disk Artifact Acquisition** (when `--disk` specified)
   - Collect recently modified files (mtime within investigation window)
   - Acquire suspicious directories identified during triage
   - Preserve deleted file metadata via `debugfs` or `extundelete`
   - Capture partition layout and mount state

6. **Cloud Evidence Acquisition** (when `--cloud` specified)
   - AWS: Create EBS snapshot of instance volume, export CloudTrail events to JSON, generate and download IAM credential report
   - Azure: Create VM disk snapshot, export Activity Log to JSON
   - GCP: Create disk snapshot, export Audit Logs to JSON
   - Compute SHA-256 for each downloaded artifact; record cloud snapshot IDs in evidence manifest (integrity attested by provider)

7. **Container Evidence Acquisition** (when `--container` specified)
   - Enumerate running and stopped containers on target
   - For each relevant container: collect logs (`docker logs`), export filesystem (`docker export`), capture inspect metadata (`docker inspect`)
   - Compute SHA-256 for each artifact
   - Containers are not stopped or removed until all evidence is secured

8. **Integrity Verification**
   - Verify SHA-256 of each acquired artifact against original
   - Record match/mismatch status in evidence manifest
   - Flag any verification failures for investigator review

9. **Evidence Manifest**
   - Generate `evidence-manifest.yaml` with all artifact metadata
   - Include: filename, original path, collected timestamp, hash, size
   - Update chain-of-custody log with completion entry
   - Write `custody-log.yaml` with full acquisition audit trail

## Examples

### Example 1: Acquire logs only
```bash
/forensics-acquire ssh://admin@192.168.1.50 --logs

Example 2: Acquire logs and config

/forensics-acquire ssh://admin@192.168.1.50 --logs --config

Example 3: Full acquisition

/forensics-acquire ssh://root@10.0.0.5 --all

Example 4: Logs since incident window

/forensics-acquire ssh://admin@host --logs --since 2026-02-26T18:00:00Z

Example 5: Compressed acquisition

/forensics-acquire ssh://admin@host --logs --config --compress

Example 6: Cloud evidence acquisition

/forensics-acquire aws://account-id --cloud

Example 7: Container evidence acquisition

/forensics-acquire ssh://admin@host --container

Example 8: Full acquisition including cloud and container evidence

/forensics-acquire ssh://root@10.0.0.5 --all --cloud --container

Output

Artifacts are saved to .aiwg/forensics/acquisition/:

.aiwg/forensics/acquisition/
├── evidence-manifest.yaml        # Complete artifact inventory with hashes
├── custody-log.yaml              # Chain of custody audit trail
├── logs/
│   ├── auth.log.gz
│   ├── syslog.gz
│   ├── btmp.gz
│   ├── dpkg.log.gz
│   ├── journal-export.bin.gz
│   └── audit.log.gz
├── snapshots/
│   ├── login-history.txt
│   ├── failed-logins.