carves

var CarveSamples = []CarveSample{

	{
		Label:    "/etc/passwd",
		Path:     "/etc/passwd",
		Platform: CarvePlatformLinux,
		Category: CarveCategoryAuth,
		Notes:    "Local user account database (read by every getpwnam call).",
	},
	{
		Label:    "/etc/shadow",
		Path:     "/etc/shadow",
		Platform: CarvePlatformLinux,
		Category: CarveCategoryAuth,
		Notes:    "Hashed password store — root-readable only; presence in carve output confirms agent ran as root.",
	},
	{
		Label:    "/etc/sudoers",
		Path:     "/etc/sudoers",
		Platform: CarvePlatformLinux,
		Category: CarveCategoryAuth,
		Notes:    "Sudo privilege configuration. Compare across hosts to spot drift.",
	},

	{
		Label:    "/var/log/auth.log",
		Path:     "/var/log/auth.log",
		Platform: CarvePlatformLinux,
		Category: CarveCategoryLogs,
		Notes:    "SSH / sudo / PAM authentication events (Debian / Ubuntu).",
	},
	{
		Label:    "/var/log/secure",
		Path:     "/var/log/secure",
		Platform: CarvePlatformLinux,
		Category: CarveCategoryLogs,
		Notes:    "SSH / sudo / PAM authentication events (RHEL / CentOS / Fedora).",
	},
	{
		Label:    "/var/log/syslog",
		Path:     "/var/log/syslog",
		Platform: CarvePlatformLinux,
		Category: CarveCategoryLogs,
		Notes:    "General system messages; correlate with auth.log for a fuller timeline.",
	},

	{
		Label:    "/root/.bash_history",
		Path:     "/root/.bash_history",
		Platform: CarvePlatformLinux,
		Category: CarveCategoryHistory,
		Notes:    "Root shell command history — first thing to grab on suspected compromise.",
	},
	{
		Label:    "/etc/crontab",
		Path:     "/etc/crontab",
		Platform: CarvePlatformLinux,
		Category: CarveCategoryConfig,
		Notes:    "System-wide cron schedule. Check for unfamiliar entries.",
	},
	{
		Label:    "/etc/hosts",
		Path:     "/etc/hosts",
		Platform: CarvePlatformLinux,
		Category: CarveCategoryConfig,
		Notes:    "Local hostname overrides. Tampered entries can redirect traffic.",
	},

	{
		Label:    "/etc/passwd",
		Path:     "/etc/passwd",
		Platform: CarvePlatformDarwin,
		Category: CarveCategoryAuth,
		Notes:    "Local user account database (legacy; macOS primarily uses OpenDirectory).",
	},
	{
		Label:    "/var/db/dslocal/nodes/Default/users",
		Path:     "/var/db/dslocal/nodes/Default/users",
		Platform: CarvePlatformDarwin,
		Category: CarveCategoryAuth,
		Notes:    "Local user records in OpenDirectory (plist files; carve the directory).",
	},

	{
		Label:    "~/Library/Keychains",
		Path:     "/Users",
		Platform: CarvePlatformDarwin,
		Category: CarveCategoryKeychain,
		Notes:    "User keychain directories. Carve a specific user's path: /Users/<user>/Library/Keychains.",
	},
	{
		Label:    "/var/log/system.log",
		Path:     "/var/log/system.log",
		Platform: CarvePlatformDarwin,
		Category: CarveCategoryLogs,
		Notes:    "Pre-unified-logging system messages.",
	},
	{
		Label:    "/var/log/install.log",
		Path:     "/var/log/install.log",
		Platform: CarvePlatformDarwin,
		Category: CarveCategoryLogs,
		Notes:    "Software install / update events — useful for spotting unexpected pkg installs.",
	},

	{
		Label:    "~/.zsh_history (root)",
		Path:     "/var/root/.zsh_history",
		Platform: CarvePlatformDarwin,
		Category: CarveCategoryHistory,
		Notes:    "Root zsh history. Adjust path for non-root users: /Users/<user>/.zsh_history.",
	},
	{
		Label:    "/etc/hosts",
		Path:     "/etc/hosts",
		Platform: CarvePlatformDarwin,
		Category: CarveCategoryConfig,
		Notes:    "Local hostname overrides.",
	},

	{
		Label:    `SAM hive`,
		Path:     `C:\Windows\System32\config\SAM`,
		Platform: CarvePlatformWindows,
		Category: CarveCategoryRegistry,
		Notes:    "Local account database hive. File is locked while Windows runs; carve from VSS shadow or live-running osquery as SYSTEM.",
	},
	{
		Label:    `SYSTEM hive`,
		Path:     `C:\Windows\System32\config\SYSTEM`,
		Platform: CarvePlatformWindows,
		Category: CarveCategoryRegistry,
		Notes:    "System configuration hive. Contains services, drivers, BootKey for SAM decryption.",
	},
	{
		Label:    `SECURITY hive`,
		Path:     `C:\Windows\System32\config\SECURITY`,
		Platform: CarvePlatformWindows,
		Category: CarveCategoryRegistry,
		Notes:    "Local security policy hive. Contains LSA secrets and cached domain credentials.",
	},

	{
		Label:    `Security event log`,
		Path:     `C:\Windows\System32\winevt\Logs\Security.evtx`,
		Platform: CarvePlatformWindows,
		Category: CarveCategoryLogs,
		Notes:    "Windows security audit log — logon events, privilege use, object access.",
	},
	{
		Label:    `System event log`,
		Path:     `C:\Windows\System32\winevt\Logs\System.evtx`,
		Platform: CarvePlatformWindows,
		Category: CarveCategoryLogs,
		Notes:    "System events — services, drivers, hardware. Pairs with Security.evtx for correlation.",
	},
	{
		Label:    `PowerShell op log`,
		Path:     `C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx`,
		Platform: CarvePlatformWindows,
		Category: CarveCategoryLogs,
		Notes:    "PowerShell script-block and pipeline execution log. High-value for attacker activity.",
	},

	{
		Label:    `hosts file`,
		Path:     `C:\Windows\System32\drivers\etc\hosts`,
		Platform: CarvePlatformWindows,
		Category: CarveCategoryConfig,
		Notes:    "Local hostname overrides. Should rarely change in a managed fleet.",
	},
	{
		Label:    `NTUSER.DAT (per-user)`,
		Path:     `C:\Users`,
		Platform: CarvePlatformWindows,
		Category: CarveCategoryConfig,
		Notes:    "Per-user registry hive. Carve a specific user: C:\\Users\\<user>\\NTUSER.DAT (locked while user is logged in).",
	},
}

var (
	// CompressionHeader to detect the usage of compressed carves (zstd header)
	// https://github.com/facebook/zstd
	CompressionHeader = []byte{0x28, 0xb5, 0x2f, 0xfd}
)