diff --git a/Makefile b/Makefile index 549583c..5004810 100644 --- a/Makefile +++ b/Makefile @@ -72,21 +72,6 @@ generate-win: generate rsrc -arch amd64 -manifest build/win/artifactcollector.exe.user.manifest -ico build/win/artifactcollector.ico -o build/win/artifactcollector.user.syso rsrc -arch 386 -manifest build/win/artifactcollector32.exe.user.manifest -ico build/win/artifactcollector.ico -o build/win/artifactcollector32.user.syso -.PHONY: build -build: generate - @echo "Building..." - go build -o build/bin/artifactcollector . - -.PHONY: build-linux -build-linux: generate - @echo "Building for Linux..." - GOOS=linux GOARCH=amd64 go build -o build/bin/artifactcollector-linux . - -.PHONY: build-darwin -build-darwin: generate - @echo "Building for macOS..." - GOOS=darwin GOARCH=amd64 go build -o build/bin/artifactcollector-darwin . - .PHONY: build-win build-win: generate-win @echo "Building for Windows..." diff --git a/README.md b/README.md index 76e50ae..71075f4 100644 --- a/README.md +++ b/README.md @@ -61,18 +61,18 @@ The zip file contains the results of the extraction and needs to be transferred ## Build your own artifactcollector 1. Clone the repository: `git clone https://github.com/forensicanalysis/artifactcollector`. -2. Add artifact definition yaml files as needed in `config/artifacts`. Do not edit the - artifact definitions, as they will be overwritten. +2. Add and edit artifact definition yaml files as needed in `config/artifacts`. 3. Edit `config/ac.yaml` and add the artifacts you want to collect. 4. On windows, you can move the syso into the root folder (e.g. `cp resources\artifactcollector.syso .`) to enable the icon for the executable and the UAC popup. -5. Run `make build` to generate the artifactcollector binary. +5. Run `go build .` to generate the artifactcollector binary. + 1. You can also use `GOOS=windows GOARCH=amd64 go build -o artifactcollector.exe .` to cross-compile for Windows. ## Embed binaries Binaries can be added to `config/bin` and then included into the artifactcollector -in the `make build` step. Additionally, a corresponding COMMAND artifact like -the following is required. +in the `go build` step. Additionally, a corresponding COMMAND artifact like +the following is required: ```yaml name: Autoruns @@ -84,12 +84,19 @@ sources: supported_os: [ Windows ] ``` -The command output to stdout and stderr is saved, but generated -files are not collected. +The command output to stdout and stderr is saved, but generated files are not collected. + +## Acknowledgement + +The artifactcollector uses on the following great projects: + +- [config/artifacts](config/artifacts) is based on the awesome [Forensic Artifacts](https://github.com/ForensicArtifacts/artifacts) project. +- [doublestar](doublestar) is based on [Bob Matcuk's](https://github.com/bmatcuk) great [doublestar](https://github.com/bmatcuk/doublestar) package. +- [store/aczip](store/aczip) and [build/go](build/go) contain code from the Go standard library. ## License Most of the artifactcollector is licensed under the MIT License. See [MIT license](LICENSE) for the full license text. The directories [store/aczip](store/aczip) and [build/go](build/go) contain code from the Go standard library -which is licensed under the [BSD-3-Clause license](LICENSE-BSD). \ No newline at end of file +which is licensed under the [BSD-3-Clause license](LICENSE-BSD). diff --git a/config/ac.yaml b/config/ac.yaml index 9800c96..9cfe97a 100644 --- a/config/ac.yaml +++ b/config/ac.yaml @@ -1 +1,4 @@ artifacts: ["DefaultCollection1"] # artifact definitions to collect +user: false # optional, if true, do not request admin permissions +case: "" # optional case name +output_dir: "" # optional output directory \ No newline at end of file