dfirgen

package

v0.4.1 Latest Latest Go to latest Published: Aug 16, 2026 License: MPL-2.0 Imports: 5 Imported by: 0

Documentation ¶

Overview ¶

Package dfirgen writes a deterministic synthetic Windows triage tree: event logs, registry hives, prefetch files, IIS logs and PowerShell history. Sizes scale with a total budget, content comes from a seeded RNG so runs are reproducible, and a known subset of text files carries the IOCMarker string so a grep pass has an exact expected hit count. Test data only; no file here is a real forensic artifact.

Index ¶

Constants
type Summary
- func Generate(root string, totalMB int, seed int64) (*Summary, error)

Constants ¶

View Source

const IOCMarker = "KD-DFIR-IOC"

IOCMarker is the string a triage grep hunts for. Clearly synthetic on purpose: the tests need an exact count, not realism.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Summary ¶

type Summary struct {
	Files    int
	Bytes    int64
	IOCFiles int
	// Extract lists the KAPE-style pull set as root-relative paths:
	// event logs, registry hives, prefetch, PowerShell history.
	Extract []string
}

Summary reports what Generate wrote.

func Generate ¶

func Generate(root string, totalMB int, seed int64) (*Summary, error)

Generate writes the tree under root and returns what it wrote. The same (totalMB, seed) pair always produces the same tree.

Source Files ¶

View all Source files

dfirgen.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL