Skip to content

Home

Jump to bottom
github-actions[bot] edited this page Sep 6, 2026 · 3 revisions

Arachnid Core — Wiki

Live triage and network forensics for the Arachnid Forensic suite.

Arachnid Core collects volatile system state and network evidence from a running host into a tamper-evident, cryptographically signed evidence container. It is read-only against the target: the only writes go to the container directory you name.

For use by authorized analysts on systems they have permission to examine.

The suite also ships Arachnid Recover, which pulls deleted files back out of an acquired image — see File Recovery — and Arachnid Sanitize, which is the one tool here that destroys data — see Secure Erasure.

arachnid-core collect     -o ./ev-host01              # volatile state
arachnid-core capture     -o ./ev-net -d eth0 --duration 300 -f "not port 22"
arachnid-core parse-pcap  suspicious.pcap -o ./ev-pcap
arachnid-core verify      ./ev-host01                 # exit 0 = intact, 3 = tampered
arachnid-core report      ./ev-host01 --format html -o triage.html

arachnid-tui                                          # the same engine, driven from a TUI

arachnid-recover scan   -i ./ev-host01/artifacts/disk.img -o ./rec --carve-pass
arachnid-recover export -i ./rec/results.json -o ./rec/out --confidence high,medium

Start here

If you are… Read
New to the tool Getting Started
An incident responder with a host in front of you Workflows
Looking up a flag CLI Reference
Driving the TUI Terminal UI Guide
A SOC being asked to allow this binary Security & Threat Model, then SOC Allowlisting
Consuming the output from another tool Reports & Schemas
Producing a Section 63 BSA certificate for a container CLI Reference § certify
Recovering deleted files from an image File Recovery
Wiping a drive for disposal Secure Erasure
Contributing code Development
Stuck Troubleshooting · FAQ

All pages

  1. Getting Started — requirements, building, release builds, your first container, verifying a release binary.
  2. Core Concepts — the design stance, the evidence container, custody chains, degraded collection, exit codes, the read-only rule.
  3. CLI Reference — every subcommand, every flag, worked examples with real output.
  4. Terminal UI Guide — all nine screens, every key, editing, confirmations, layout behaviour, persisted state.
  5. The Evidence Container — the on-disk format byte by byte, the hash chain, the signing scheme, what verification checks and in what order.
  6. Collectors — what each collector gathers, every path and registry key read, per-platform behaviour, data shapes.
  7. Network Forensics — live capture, BPF filters, drops, TCP reassembly, indicator extraction.
  8. Reports & Schemas — the JSON contract, the Markdown and HTML renderings, schema versioning, validating output.
  9. Workflows — end-to-end playbooks: endpoint triage, network investigation, third-party verification, SOAR integration, air-gapped analysis.
  10. Security & Threat Model — what Arachnid defends against, what it explicitly does not, non-goals, supply chain.
  11. Development — the eleven crates, building, testing, CI, and how to add a collector or a screen.
  12. Troubleshooting — every error message you are likely to see, and what to do about it.
  13. FAQ — the questions that come up in review.
  14. Secure Erasure — Arachnid Sanitize: methods and compliance, the safety rails, the CLI, read-back verification, signed certificates. This module destroys data.
  15. File Recovery — Arachnid Recover: NTFS, ext4 and APFS parsing, signature carving, confidence scoring and its rationale, the CLI, and how a recovery export verifies as evidence.

Three things to internalize before you run it

1. Record the key fingerprint. Every run prints one. Without --signing-key, the signing key is generated per run, and verify can then prove only that a container is internally consistent — not who produced it. See Signing Keys.

2. One binary in this suite destroys data. arachnid-core, arachnid-recover and arachnid-tui are read-only against the target. arachnid-sanitize is not — it exists to make a device unreadable, and a wipe cannot be undone. It is a separate allowlisting decision and a separate habit: --dry-run first, every time. See Secure Erasure.

3. A compromised kernel lies to you. Every collector reads through OS APIs. A rootkit that hooks those APIs hides from Arachnid exactly as it hides from ps. Live triage is one input, not the answer. See What it does not defend against.

The suite

Module Status
Arachnid Core shipping — arachnid-core, arachnid-tui. Read-only
Arachnid Recover shipping — arachnid-recover, and screen 8 of the TUI. Read-only. See File Recovery
Arachnid Sanitize shipping — arachnid-sanitize, and screen 7 of the TUI. Destroys data. See Secure Erasure

Core acquires, Recover extracts, Sanitize destroys. Recover reads Core's containers directly and writes its exports back into new ones, so the whole chain verifies with arachnid-core verify.

Other documents in this repository

Document For
README.md the repository front page
arachnid-usage-guide.md task-oriented usage guide for operators
docs/SOC-ALLOWLISTING.md full behavioural disclosure for detection engineering
schema/report.schema.json the report contract
schema/custody.schema.json one custody record
schema/samples/ a real erasure certificate and a real recovery results index, both generated by a test
test-fixtures/ synthetic NTFS and ext4 images for the recovery parsers. No real data

Version documented: 0.1.0. Report schema 1.0.0, container schema 1.0.0, certificate schema 1.0.0. Licensed MIT.

Arachnid Core Wiki

Clone this wiki locally