Arachnid Core — Wiki

Live triage and network forensics for the Arachnid Forensic suite.

Arachnid Core collects volatile system state and network evidence from a running host into a tamper-evident, cryptographically signed evidence container. It is read-only against the target: the only writes go to the container directory you name.

For use by authorized analysts on systems they have permission to examine.

The suite also ships Arachnid Recover, which pulls deleted files back out of an acquired image — see File Recovery — and Arachnid Sanitize, which is the one tool here that destroys data — see Secure Erasure.

arachnid-core collect     -o ./ev-host01              # volatile state
arachnid-core capture     -o ./ev-net -d eth0 --duration 300 -f "not port 22"
arachnid-core parse-pcap  suspicious.pcap -o ./ev-pcap
arachnid-core verify      ./ev-host01                 # exit 0 = intact, 3 = tampered
arachnid-core report      ./ev-host01 --format html -o triage.html

arachnid-tui                                          # the same engine, driven from a TUI

arachnid-recover scan   -i ./ev-host01/artifacts/disk.img -o ./rec --carve-pass
arachnid-recover export -i ./rec/results.json -o ./rec/out --confidence high,medium

Start here

All pages

1. Getting Started — requirements, building, release builds, your first container, verifying a release binary.
2. Core Concepts — the design stance, the evidence container, custody chains, degraded collection, exit codes, the read-only rule.
3. CLI Reference — every subcommand, every flag, worked examples with real output.
4. Terminal UI Guide — all nine screens, every key, editing, confirmations, layout behaviour, persisted state.
5. The Evidence Container — the on-disk format byte by byte, the hash chain, the signing scheme, what verification checks and in what order.
6. Collectors — what each collector gathers, every path and registry key read, per-platform behaviour, data shapes.
7. Network Forensics — live capture, BPF filters, drops, TCP reassembly, indicator extraction.
8. Reports & Schemas — the JSON contract, the Markdown and HTML renderings, schema versioning, validating output.
9. Workflows — end-to-end playbooks: endpoint triage, network investigation, third-party verification, SOAR integration, air-gapped analysis.
10. Security & Threat Model — what Arachnid defends against, what it explicitly does not, non-goals, supply chain.
11. Development — the eleven crates, building, testing, CI, and how to add a collector or a screen.
12. Troubleshooting — every error message you are likely to see, and what to do about it.
13. FAQ — the questions that come up in review.
14. Secure Erasure — Arachnid Sanitize: methods and compliance, the safety rails, the CLI, read-back verification, signed certificates. This module destroys data.
15. File Recovery — Arachnid Recover: NTFS, ext4 and APFS parsing, signature carving, confidence scoring and its rationale, the CLI, and how a recovery export verifies as evidence.

Three things to internalize before you run it

1. Record the key fingerprint. Every run prints one. Without --signing-key, the signing key is generated per run, and verify can then prove only that a container is internally consistent — not who produced it. See Signing Keys.

2. One binary in this suite destroys data. arachnid-core, arachnid-recover and arachnid-tui are read-only against the target. arachnid-sanitize is not — it exists to make a device unreadable, and a wipe cannot be undone. It is a separate allowlisting decision and a separate habit: --dry-run first, every time. See Secure Erasure.

3. A compromised kernel lies to you. Every collector reads through OS APIs. A rootkit that hooks those APIs hides from Arachnid exactly as it hides from ps. Live triage is one input, not the answer. See What it does not defend against.

The suite

Core acquires, Recover extracts, Sanitize destroys. Recover reads Core’s containers directly and writes its exports back into new ones, so the whole chain verifies with arachnid-core verify.

Other documents in this repository

Version documented: 0.1.0. Report schema 1.0.0, container schema 1.0.0, certificate schema 1.0.0. Licensed MIT.