SakshyaYantra Mobile on the command line
Every command this product contains and every parameter it accepts: 24 commands, 107 parameters. Read from the shipping build, version 20.54.3.6. The help text says what a switch does; each entry here adds when a business reaches for it and what it costs.
Before the first command
- Reading a physical drive needs administrator rights. Working from a disk image needs none.
- The source is opened read-only for the whole session, and the application refuses a destination on the drive being read.
- Set the mode before the scan. A recovery-mode scan does not become evidential afterwards.
- Everything below is available in the application as well; the command line is the scriptable surface, not a separate product.
recoveryantra advise
<workspace> | The job (e.g. recovery, forensics, cctv); omit to list the jobs this product guides When to use it. The job you are on - recovery, forensics, cctv, imaging and so on. You get the one next step, why it is the right one, and the exact command to run it. Leave it out to list the jobs this product guides. Use it when you are partway through and not sure what comes next, and give it to new staff so they never have to guess the order. What it costs. It only advises steps the product you are running can do; a job the product does not contain is refused by naming the product. |
|---|---|
--done | Steps you have already finished, comma-separated (e.g. stop_using,triage); the advice moves on When to use it. The steps you have already finished, as a comma-separated list of the step ids the advice printed (for example stop_using,health). The advice moves on to what is left. Use it each time you finish something, so the next step is always the right one. What it costs. You say what is done; the advisor never decides that for you. A step it does not recognise is ignored and the advice says so. |
--plan | Show the whole ordered path with the reason for each step, not only the next one When to use it. Print the whole ordered path for the job, with the reason for every step, instead of only the next one. Use it before you start, to see the shape of the job, or when you are briefing someone who will do it. What it costs. Steps this product cannot perform are left out, so the plan never contains an action you do not have. |
--workflow | Pick one procedure when a job has several (listed by `advise` with no argument) When to use it. Choose one procedure when a job has several - for example the recovery job also has finding one file and recovering a virtual machine. Run advise on its own to see the choices. Use it when the default procedure is not the job you were handed. |
--json | Print the advice as JSON for scripts When to use it. Print the advice as JSON, one record per recommendation with its reason, command, status and step id, so a script or a case system can read it. Use it when advise feeds another tool rather than a person. What it costs. The wording is the same as on screen; only the layout changes. |
recoveryantra capabilities
--enable | Turn on an advanced method (e.g. checkm8, mtk_bootrom, qualcomm_edl) When to use it. Turn on an advanced acquisition method for a case that needs it and is authorised for it. These methods interact with the device, so they are off until an examiner opts in on the record. What it costs. Enabling is recorded in the audit trail with the operator and case. An advanced method can alter the device; decide before the exhibit is in front of you, not during. |
|---|---|
--disable | Turn an advanced method back off When to use it. Turn a method back off once the step that needed it is complete, so the next case starts from the conservative default. |
--tools | Show the acquisition toolbox: the public methods (checkm8/mtkclient/edl/adb...), what's installed, and what is equipped for this case When to use it. Run before an acquisition to see which external tools are actually installed on this machine and which methods are therefore available today. What it costs. The product orchestrates the operator's own tools for advanced methods; it does not bundle exploits. A method with no tool present is not available however the case is authorised. |
--operator | Examiner making the choice (recorded) When to use it. Name the examiner making the decision. The choice belongs in the record alongside the result it produced. |
--case | Case reference (recorded) When to use it. Tie the capability decision to the case it was made for. |
recoveryantra case
<case_cmd> | When to use it. Group several recovered sources - a laptop disk, a backup stick, a phone image - into one case for a single customer or job, and see everything recovered across them in one place, deduplicated by hash. `new` starts a case; `add` puts a source into it; `list` shows the cases or one case's sources; `status` totals its files and duplicates; `dedup` lists files found in more than one source. Use it when a job is more than one drive and you do not want to hand back the same file three times. |
|---|
recoveryantra casequery
<question> | The question to ask over the case When to use it. The triage question to ask over the case's own indexed data, such as who met whom and when, or whether a confession appears. Retrieval returns the case items that bear on it; a model answer, if any, is an observation, never a finding. |
|---|---|
--case | The case folder (defaults to the most recent case) When to use it. The case folder to query when it is not the most recent case, which is used by default. Only the case's own indexed data is searched, nothing outside it. |
--reading | Your OWN reading of the case, sealed into the audit trail before any model answer is shown When to use it. Your own reading of the case, sealed into the audit trail before any model answer is disclosed, so the record shows what the examiner concluded independently of the tool. What it costs. It is sealed once; a later change is recorded as an edit, never as the original reading. |
--inconclusive | Seal your reading as inconclusive instead of typing one When to use it. Seal your reading as inconclusive rather than typing one, for when the case does not yet support a reading but you still want the model's words disclosed and audited. |
--examiner | Who is asking, recorded with the sealed reading When to use it. Who is asking, recorded with the sealed reading and the audited reveal so the trail names the person who saw the model's words. |
--reveal | After sealing a reading, disclose the model's verbatim words (an audited event). Without a sealed reading the model's words stay sealed When to use it. Disclose the model's verbatim words after a reading is sealed, which is an audited event recorded with who did it and when. What it costs. The model's text is an observation, never a finding; revealing it puts a record in the audit trail that it was seen. |
--limit | How many case items to retrieve as context When to use it. How many case items to retrieve as context for the question, when the default breadth is too wide or too narrow for the case. |
recoveryantra caseworkflow
--case | The case folder; omit to use the most recent case When to use it. The case folder to report on. Omit it and the most recently worked case is used, so an examiner mid-case runs the command with no arguments. Read only - the trail is never re-opened or locked. What it costs. Free: it reads the case's own audit.jsonl and case.json and writes a report; it charges nothing and touches no evidence. |
|---|---|
--out | Where to write the report (default: the case's reports/ folder) When to use it. Where to write the report. The default is the case's own reports/ folder, so it travels with the case; point it elsewhere to hand a copy straight to a shared drive. |
--format | Comma list of html,pdf,text (default all three; PDF only where reportlab is present) When to use it. A comma list of html, pdf and text (default all three). The HTML is self-contained - screenshots are embedded - so one file can be shared as the whole workflow; PDF is written where reportlab is present. |
--shot | A screenshot to attach (repeatable); PATH or PATH::caption When to use it. A screenshot to attach, repeatable, as PATH or PATH::caption. Each is embedded in the HTML so the report is one shareable file; a path that cannot be read is noted in the report as not-found, never dropped silently. |
recoveryantra certify
<cecmd> | When to use it. Draft the Section 63(4) Bharatiya Sakshya Adhiniyam certificate from a case's exhibits, or re-verify one already issued. |
|---|
recoveryantra crosscase
<xccmd> | When to use it. Pick what to do: `ingest` adds a case's properties to the lab store, `lookup` finds which cases carry a value, `correlate` shows what a case shares with others, `forget` removes a case, `export`/`import` move the store, `stats` summarises it. |
|---|
recoveryantra detect
--report | Also write the report (HTML, PDF, JSON) into DIR When to use it. Write the detection report - HTML, PDF and JSON - into this folder: every device with its state, bus, serial and sector size, the hardware Windows can see but cannot use with the code and the fix, and the Plug-and-Play inventory. Use it when a customer or a partner says a drive is not detected: the report replaces "it does not work" with what the machine actually sees. What it costs. The folder goes through the same pre-flight as every other writing job; the report is small, so only rights and a full disk stop it. |
|---|---|
--no-health | Skip the health read of each usable drive (faster) When to use it. Skip the health read of each usable drive. Detection is then a listing only and returns in a second or two. Use it on a machine with many drives, or when a drive is known to be failing and you do not want even a test read against it before imaging. |
--force | Write the report even if the pre-flight objects When to use it. Write the report even when the pre-flight objects to the folder. Use it only when you have read the objection and it does not apply - a report is a few hundred kilobytes, so the usual reason is a destination the check cannot judge. What it costs. A refusal you have not read is not one you can override safely. |
recoveryantra find-drive
<pattern> | A filename, part of one, or a wildcard (e.g. IMG_2019, *.jpg) When to use it. Search every usable attached device for a file whose name matches PATTERN, without picking a drive first. Free, no licence needed - reads each device's index in seconds, the same tier as `--list`. Use it when the customer cannot say which of several drives holds what they want. |
|---|---|
--timeout | Give up on one drive after this long (default 20); a slow or failing drive never holds up the others When to use it. Seconds allowed per device before moving on. A slow or failing device costs only its own row - the sweep never waits on one device at the expense of the rest. |
--all | List every drive checked, including the ones with no match When to use it. Also sweep devices that are not in a normally-usable state, where possible. Use it only once the plain sweep has come back empty. |
recoveryantra gui
--classic | Use the classic Tkinter wizard When to use it. Fall back to the classic interface on a machine where the modern window will not start, typically an old or minimal Windows install. |
|---|
recoveryantra guide
--html | Write the guide as a self-contained, searchable HTML page When to use it. Produce the manual as a single searchable page to hand to a client, put on an internal share, or carry onto an air-gapped bench. |
|---|---|
--markdown | Write the guide as Markdown When to use it. Produce Markdown when the content is going into your own documentation system or version control. |
recoveryantra guides
<gcmd> | When to use it. Read the how-to guides for this product: list them, print one as plain text, open the bundled page or PDF, or copy one out to a folder. Each guide says plainly where this product stops. |
|---|
recoveryantra ingest
<ig_command> | When to use it. Add evidence to a case and process it through one pipeline with a live dashboard. `add` enqueues a source; `run` runs the stages; `status` prints the dashboard; `flagged` lists what the analysis stages flagged; `stop` halts at a stage boundary; `retry` re-queues a failed stage. |
|---|
recoveryantra legal
--status | Show what has been acknowledged on this install When to use it. Show what lawful-use acknowledgements have been made on this install. Useful when auditing a shared bench machine. |
|---|---|
--reset | Forget remembered acknowledgements (history is kept) When to use it. Clear the remembered acknowledgements when a machine changes hands or a new operator takes it over. What it costs. The history is retained. Resetting does not erase the record of what was previously acknowledged. |
recoveryantra licence
<lic_command> | When to use it. Manage this computer's licence from the terminal: `status` shows the licence, what is left on it and this computer's System Key (the code a key is issued for); `activate` applies a key issued for this computer; `deactivate` removes it. Use it on a headless or scripted install, or to read the System Key to send with a key request. Offline - nothing is sent anywhere. |
|---|
recoveryantra license
<lic_command> | When to use it. The same command as `licence` (US spelling): status, activate KEY, deactivate. |
|---|
recoveryantra list
--triage | Also check each device's health (SMART + test reads), how it's connected, and what kind of device it is (CCTV recorder, phone, dashcam, card, ...) with advice on what to do When to use it. Run before touching anything. It reports each device's health, how it is connected and what kind of device it is, which is what decides whether to recover directly or image first. What it costs. Triage reads the drive. On a drive that is audibly failing, keep even this brief and go straight to imaging. |
|---|
recoveryantra phone
--store | A phone SQLite database (mmssms.db, msgstore.db, sms.db, contacts2.db, ...) When to use it. Point at a single database pulled from a handset when you already know which application's data you need. |
|---|---|
--deep | Deep-mine a PULLED phone folder for DELETED data (trash, deleted DB rows, thumbnails of purged photos) When to use it. Run against a whole pulled phone folder when deleted material matters: trash folders, deleted database rows and thumbnails of photographs that are no longer present. What it costs. Deep mining takes considerably longer than reading one store, and recovered deleted rows are reported flagged as such. |
--app | Force a profile (android_sms, android_calls, whatsapp, ios_imessage); auto-detected if omitted When to use it. Force a profile when auto-detection picks the wrong one, usually on a renamed or unusually located database. |
--key | Decryption key for an encrypted store: path to a WhatsApp `key` file, or a hex key (WhatsApp crypt / SQLCipher: Signal, WeChat, Wickr, ...) When to use it. Supply the key for an encrypted store: a WhatsApp key file, or a hex key for an SQLCipher database. What it costs. Without the key the store cannot be read. The product does not attempt to break the encryption and will say so rather than returning partial output. |
--deleted-only | Show only recovered deleted records When to use it. Narrow the output to recovered deleted records when the live data is already available from the handset or a backup. |
--areas | Instead of parsing, list the mobile recovery areas (by app + media) When to use it. Use when scoping. It lists what is recoverable per application and media type, including the areas that are honestly not recoverable locally. What it costs. Applications listed as not locally recoverable are ephemeral or server-side. Scope them out of the quote rather than promising them. |
--types | List recovery by DATA TYPE (Contacts, Messages, Photos, ...) and sources When to use it. The same scoping question asked by data type: contacts, messages, calls, photographs, and where each comes from. |
--ffs-dfu | Identify a checkm8 full-filesystem acquisition from a device's DFU USB serial (e.g. 'CPID:8015 ECID:.. SRTG:[..]') and print the honest, ordered FFS plan When to use it. Establish whether a full-filesystem acquisition is possible for a specific iPhone before promising one, from the device's own DFU identifiers. What it costs. The plan states the answer for that device. An unknown chip is never assumed to be reachable. |
--android-ffs | Plan an Android full-filesystem acquisition from a device descriptor (VID:PID and/or 'chipset:SM8250 android:13 bootloader:locked credential:unknown'): SoC, download mode, and the honest FBE boundary When to use it. The same question for Android, from the device descriptor. Produces a plan gated on what that specific device actually allows. |
--cloud-tokens | Scan a lawfully-acquired artifact/file for cloud-account tokens (OAuth refresh/access, JWT) and print the lawful cloud-acquisition route per provider (identify-only) When to use it. Scan a lawfully acquired artefact for cloud account tokens, and get the lawful route to the provider rather than to the account. What it costs. Finding a token is not authority to use it. The output is a lawful acquisition route, and it should be followed. |
--methods | List the full mobile-acquisition method registry (in-house protocol / external tool / licensed seam, state, BFU/AFU, certification, provenance) When to use it. List every mobile-acquisition method the engine carries: in-house protocol, detected external tool, or licensed capability package; the state it yields, whether it works before first unlock, and its certification (proto-proven vs needing a device to certify). |
--plan | Rank the acquisition methods that apply to a device: an iOS DFU serial (CPID:.. ECID:..) or an Android descriptor (VID:PID / chipset:.. / adb:device / adb:device+root); honest about what this build offers and, if nothing reaches the device, what WOULD and what it needs When to use it. Rank the methods that actually apply to a described device (an iOS DFU serial or an Android descriptor) - honest about what THIS build offers, and, when nothing reaches the device, which method WOULD and exactly what it needs. What it costs. A recovery build lists a physical method as NOT offered rather than hiding it; only the Forensic Suite may run one. |
--acquire-method | MANUAL acquisition: run ONE method from --methods against a device descriptor (paired with --plan's DESCRIPTOR) into --dest; refused for a build without full mobile acquisition (the recovery family keeps consent-only) When to use it. Run one named method from --plan's device against --dest. Behind the same lawful-use gate as every forensic acquisition. What it costs. Refused by naming the PRODUCT when the build lacks full mobile acquisition, and refused structurally (never a fake success) when the physical device, tool or loader it needs was not provided. |
--acquire-all | AUTOMATIC acquisition: work DOWN the methods that reach this device in order (checkm8 / EDL / MediaTek BROM / rooted ADB / backup), trying each until one succeeds - acquire on the first success, an honest refusal naming what is needed if none reaches it. Needs --plan DESCRIPTOR and --dest When to use it. Acquire a phone automatically: try every method that reaches the device in order (checkm8, Qualcomm EDL, MediaTek BootROM, rooted ADB, backup) until one succeeds, when you want the tool to work down the options rather than picking one by hand. What it costs. It runs real acquisition methods against the device and writes the image to the destination; the operator's stated authority is recorded, and a device the chosen method does not reach is refused, never faked. |
--dest | Destination folder for --acquire-method / --acquire-all When to use it. Where --acquire-method writes the image or the copied files, and the hashed manifest naming the method, its provenance and (for a licensed package) the authority. |
--icloud-photos | Collect the iCloud-only photo/video ORIGINALS (the ones 'Optimize iPhone Storage' keeps off the phone) with the account's Apple ID. CONTACTS APPLE OVER THE INTERNET - off unless you pass --i-understand-this-contacts-apple; needs --apple-id, --operator, --org, --case, --authority and --dest When to use it. Collect the iCloud-only photo and video originals - the ones 'Optimize iPhone Storage' keeps off the handset - for the account in scope. Used when the pictures a case needs live in iCloud rather than on the seized device. What it costs. Contacts Apple over the internet, so it is off unless --i-understand-this-contacts-apple is given, and it needs --apple-id, --operator, --org, --case, --authority and --dest. |
--apple-id | With --icloud-photos: the Apple ID (the account in scope) When to use it. With --icloud-photos: the Apple ID whose iCloud library is in scope for the collection. |
--icloud-password | With --icloud-photos: the Apple ID password. Leave it off to be asked without echo; it is never saved When to use it. With --icloud-photos: the Apple ID password. Leave the value off to be asked for it without it being shown. What it costs. It is never written to the case or to disk. |
--i-understand-this-contacts-apple | Acknowledge that --icloud-photos contacts Apple's iCloud servers over the internet (the default-deny egress exception, opened for this job only) When to use it. Acknowledge that --icloud-photos reaches Apple's iCloud servers over the internet. It opens the default-deny egress exception for this one job. What it costs. Without it the collection stays off, because reaching a third party is never silent. |
--icloud-gap-from | With --icloud-photos: read this iPhone backup's photo catalogue and fetch ONLY the originals it lacks When to use it. With --icloud-photos: read this iPhone backup's photo catalogue and fetch only the originals it is missing. Used to fill the gaps a storage-optimised backup left behind without re-downloading everything. |
--backup-password | Encrypted iOS backup password. With --acquire-method ios-backup: the device ALREADY encrypts backups and this is its password (nothing on the device is changed). With --decrypt-ios-backup: the password to decrypt with. Leave the value off to be asked without echo When to use it. The encrypted iOS backup password: the device's own password when acquiring with --acquire-method ios-backup, or the password to open an existing backup with --decrypt-ios-backup. Leave the value off to be asked for it without it being shown. What it costs. Acquiring with it changes nothing on the device; it is only read. |
--set-backup-password | With --acquire-method ios-backup: ALSO turn on the iPhone's encrypted-backup setting using --backup-password. This CHANGES THE DEVICE; it also needs --confirm-device-backup-password. It is turned back off afterwards When to use it. With --acquire-method ios-backup: also turn on the iPhone's encrypted-backup setting using --backup-password, so a device that was not already encrypting backups will produce a full one. What it costs. It CHANGES THE DEVICE, so it also needs --confirm-device-backup-password, and the setting is turned back off afterwards. |
--confirm-device-backup-password | Confirm that --set-backup-password changes the iPhone's backup-password setting When to use it. Confirm that --set-backup-password will change the iPhone's backup-password setting. Used so a device change is never made on one flag alone. |
--decrypt-ios-backup | Decrypt an ENCRYPTED iOS backup folder (needs --backup-password and --dest) into a plaintext backup the other parsers can read. The source is not changed When to use it. Decrypt an encrypted iOS backup folder (with --backup-password and --dest) into a plaintext backup the other parsers can read. Used when a backup opens nowhere because it is locked. What it costs. The source backup is not changed; the plaintext copy is written to --dest. |
--package-install | Install a signed capability package (.sypkg) after verifying its signature and every payload file's hash; refused if tampered, expired, or signed by the wrong key When to use it. Install a signed capability package (.sypkg) - a vendor's licensed loader/exploit chain under counsel's agreement - after verifying its Ed25519 signature and re-hashing every payload file against the signed manifest. What it costs. A tampered, expired, or wrong-key package is refused outright and contributes nothing to the method registry; it is never partially installed. |
--package-verify | Verify a .sypkg file WITHOUT installing it When to use it. Check a .sypkg file's signature and payload hashes WITHOUT installing it - for auditing a package before it goes anywhere near a case machine. |
--package-list | List installed, currently-verified capability packages When to use it. List the capability packages currently installed and still verifying (a package that no longer verifies is silently absent from this list, per the module's no-partial-trust rule). |
--package-remove | Remove an installed capability package When to use it. Remove an installed capability package by its package_id, and delete its extracted payload from disk. |
--leveldb | Recover key/value records from a LevelDB write-ahead log - the store Chrome, Electron apps (Discord, Slack, WhatsApp Desktop) and browser Local Storage keep. Point it at a `leveldb` folder or a single .log file When to use it. Point at a LevelDB folder or a single .log file when the data lives in a key/value store rather than SQLite, which is what Chrome, Electron chat apps and browser Local Storage use. What it costs. Only the write-ahead log (.log) is read; data already compacted into .ldb table files is a stated limit, not everything the store held. |
--breadth | Run a breadth pass over an ALREADY-ACQUIRED extraction folder with the signed mobile toolpack (iLEAPP for iOS, ALEAPP for Android) to widen coverage beyond our own parsers; needs --platform. Does nothing if the toolpack is not installed When to use it. Point at an already-acquired extraction folder to run the signed toolpack (iLEAPP or ALEAPP) over it and widen coverage past our own parsers, when a case needs the long tail of apps. What it costs. It does nothing when the toolpack is not installed, and its rows are labelled as the tool's, shown under our own parsers as corroboration. |
--platform | Which breadth tool to run for --breadth: ios (iLEAPP) or android (ALEAPP) When to use it. Choose which breadth tool runs on the extraction, ios for iLEAPP or android for ALEAPP, since the two read different artefact layouts. |
--artifacts | Parse the high-value system and app artifacts out of an ALREADY-ACQUIRED iOS or Android extraction folder (or an iTunes / Apple Devices backup) with our own decoders - KnowledgeC, Safari, SMS, calls, photos, locations, usage stats, installed apps and more - onto one timeline, deleted rows recovered. --platform ios/android forces the platform; --deleted-only shows only recovered rows When to use it. Point at an already-acquired iOS or Android extraction folder, or an iPhone backup, to read the high-value artifacts - app usage, Safari, messages, calls, photos, locations, installed apps - onto one timeline with our own decoders, when the case needs more than the chat stores. What it costs. It reads what the acquisition contains and lists, without guessing, the formats it cannot decode (Biome, protobuf usage stats); decoders are proven on the documented layouts, not yet certified on a handset image. |
--artifacts-csv | With --artifacts: also write the timeline to this CSV file When to use it. Name a CSV file to receive the artifact timeline, one row per event with its time, source file and detail, when the result goes to a spreadsheet or a report. |
--leapp | With --artifacts: ALSO drive aLEAPP (Android) / iLEAPP (iOS) and MERGE their extra artifacts into the same result, gap-filled (our native parser stays primary) and source-labelled. Optional: if the tool is not installed you get a clear coded message and the native artifacts still show When to use it. With --artifacts, ALSO run aLEAPP (Android) or iLEAPP (iOS) and merge their extra artifacts into the same result, source-labelled, with our own parser staying primary. If the tool is not installed you get a clear message and the native artifacts still show, so it is safe to leave on. |
--ioc | Scan an ALREADY-ACQUIRED extraction folder for known compromise INDICATORS from the Amnesty/MVT STIX feed (spyware domains, processes, hashes, app ids). Reports matched indicators as OBSERVATIONS, never a verdict of compromise. Runs our own stdlib indicator engine always; adds the MVT toolpack pass when installed When to use it. Scan an already-acquired extraction folder for known compromise INDICATORS from the Amnesty/MVT feed - spyware domains, processes, file hashes and app ids - when a case asks whether a phone was targeted. What it costs. A match is reported as an OBSERVATION, never a verdict of compromise; our own stdlib indicator engine always runs, and the MVT toolpack adds to it only when installed. |
--ioc-type | Which MVT check to add for --ioc when the toolpack is present (default androidqf) When to use it. Tell the MVT toolpack pass which extraction shape it is reading - androidqf, android-backup, ios-backup or ios-fs - so it applies the right checks. |
--ioc-stix | With --ioc: also write the matched indicator observations as a STIX 2.1 bundle to this file (for MISP / Autopsy / any threat-intel tool) When to use it. With --ioc: also write the matched compromise indicators as a STIX 2.1 bundle to this file, for MISP, Autopsy or any threat-intel tool. What it costs. A STIX observation set, never a verdict of compromise - a match must be corroborated by hand before any conclusion. |
--decrypt-app | Run an app-decryption BREADTH pass over an already-acquired input with a published tool (wa-crypt-tools / whatsapp-chat-exporter / signalbackup-tools / chat4n6 / tgartifacts). Our own byte-exact decrypt/parse stays PRIMARY; this widens coverage. Keys are examiner-supplied via --dp-key/--dp-keyfile; the input is the companion --dp-input. Does nothing if the tool is not installed. When to use it. Run a published app-decryption tool over an already-acquired input as a second opinion: wa-crypt-tools, whatsapp-chat-exporter, signalbackup-tools, chat4n6 or tgartifacts. What it costs. Our own byte-exact decrypt stays primary and an overlapping result is marked, never dropped; keys are examiner-supplied and never stored; a tool that is not installed does nothing. |
--dp-input | The already-acquired input for --decrypt-app: an encrypted WhatsApp .cryptNN, a decrypted msgstore.db, a Signal .backup, an extraction folder, or a Telegram tdata directory. Output goes to --dest. When to use it. The already-acquired input for --decrypt-app: an encrypted WhatsApp backup, a decrypted store, a Signal backup, an extraction folder or a Telegram tdata directory. |
--dp-key | Examiner-supplied decryption key/passphrase for --decrypt-app (e.g. the WhatsApp hex key or the Signal 30-digit passphrase). Never stored. When to use it. The examiner-supplied key or passphrase for --decrypt-app - a WhatsApp hex key or a Signal passphrase. What it costs. Never stored. Without it an encrypted input cannot be read, and the tool says so rather than returning partial output. |
--dp-keyfile | A file holding the examiner-supplied key for --decrypt-app, instead of --dp-key. When to use it. A file holding the examiner-supplied key for --decrypt-app, instead of typing it with --dp-key. |
--breadth-tool | Pick the --breadth tool explicitly. apollo/crush take an extraction folder; sysdiagnose takes a sysdiagnose archive file. Absent = the platform default (iLEAPP/ALEAPP). All are absent-safe if the toolpack is missing When to use it. Pick the second-opinion parser explicitly instead of the platform default: apollo (iOS/macOS pattern-of-life over an extraction folder), sysdiagnose (an iOS sysdiagnose archive file), or crush (SEGB / Realm / ABX formats our own engine does not read). What it costs. Each runs only when its signed toolpack is installed, does nothing otherwise, and is labelled as the tool's output beside our own parsers. |
--operator | Examiner asserting lawful authority (recorded) When to use it. As on acquire: the examiner asserting lawful authority. |
--authority | Lawful basis: warrant / consent / statutory power When to use it. As on acquire: the lawful basis for touching this device. |
--org | Examiner's organisation (recorded) When to use it. The examining organisation, recorded against the acquisition so the custody record names the body accountable for it. |
--case | Case / FIR reference (recorded) When to use it. The case reference, set consistently across every step. |
recoveryantra report
--case | The case folder When to use it. Point at the case folder you want to hand to another tool or lab. `report` exports it in a standardized interchange format rather than a PDF, so an examiner on different software can load the same evidence, timeline and provenance. The case folder is read only. |
|---|---|
--format | Export format: case-uco (CASE/UCO JSON-LD, the default), tsk-db (a Sleuth Kit / Autopsy-schema SQLite other TSK tools open), or portable (a self-contained, re-openable portable-case .zip with an offline reader). For tsk-db and portable, --case is a case id When to use it. Choose the interchange format for the export; today that is CASE-UCO, the community standard the major forensic tools read, so findings travel to another examiner without being retyped. Leave it at the default unless a receiving lab asks for a specific one. |
-o | Path to write the export to (a folder, with --template) When to use it. Where to write the exported file. Choose a path outside the case folder and the evidence drive so the export never lands among the files it describes; writing it does not change the case. |
--force | Write even if the pre-flight objects When to use it. Write the export even when the pre-flight raises an objection, such as too little free space at the destination. Use it only after you have read the warning and accept it. What it costs. The pre-flight is what stops a half-written export or a destination that cannot hold the file; forcing past it can leave an incomplete export that another tool will reject as malformed. |
--template | Write the examination report FROM this report template instead (see --list-templates); needs --case When to use it. Write the examination report from a named report template instead of the built-in layout. Used when a case or an agency has its own report format to follow. Needs --case. What it costs. See --list-templates for the templates this build carries and the ones you have added. |
--list-templates | List the report templates (built-in and your own) and stop When to use it. List the report templates, both built-in and your own, and stop without writing a report. Used to find the exact name to pass to --template. |
--site | With --template: also write the linked HTML triage site (index.html + one page per item) When to use it. With --template: also write the linked HTML triage site (an index page and one page per item) beside the report. Used when the people reading it want to click through the exhibits. |
--report | With --template: the report record to render (default: the newest) When to use it. With --template: the report record to render. Defaults to the newest record, so it is only needed to render an earlier one. |
--hub-case | With --template: render the Case Hub case with this id instead of --case When to use it. With --template: render the Case Hub case with this id instead of the folder given to --case. Used when the case lives in the Case Hub. |
recoveryantra resultset
<rs_cmd> | When to use it. Which step to run: save a selection as a named set, list the saved sets, show one, delete one, export one as reports and/or a logical evidence file, or verify a logical evidence file you wrote earlier. Run it with no step to see the list. |
|---|
recoveryantra stego
<path> | The image or file to analyse When to use it. The image or file to examine for hidden data, run whenever an exhibit might carry a concealed payload - a picture that is larger than its content explains, a file a suspect treated as important, or anything flagged for a second look. Reading only; the exhibit is never changed. |
|---|---|
--extract | Also carve out and save any hidden data that is found When to use it. Add this when the examination should also carve out and save what it finds, so recovered appended data, embedded files and LSB payloads land in a folder you can open, not only in the on-screen result. What it costs. It writes new files to the output folder; it never alters the exhibit, and an unconfirmed carve is labelled so it is not mistaken for proven. |
--out | Folder to write recovered hidden data into (with --extract) When to use it. Where the recovered hidden data is written when extraction is on, used when the default folder beside the exhibit is not where the case keeps its working files. Choose a case folder, never the exhibit's own media. |
--json | Print the full report as JSON instead of as text When to use it. Print the full report as JSON instead of text, used when another tool or a case script consumes the result rather than a person reading it. |
recoveryantra steps
<workflow> | Workflow id (e.g. forensics, data_recovery); omit to list them by category When to use it. Show the full procedure for one job - every stage, what it is for, the safety gates that cannot be skipped, and the command that carries each one out. Use it when a technician is doing a job for the first time, when a job is done rarely enough that nobody remembers the order, or when a reviewer asks why the work was done the way it was. |
|---|---|
--category | Show only one category's workflows When to use it. Show only data recovery, or only forensics. The two follow different orders because they are for different things: a recovery is judged on how much comes back, an examination on whether you can prove what you did. Verification therefore ends a recovery and sits in the MIDDLE of an examination, before any analysis. Use this to hand a new examiner only the sequence that applies to them. |
--commands | Print only the commands, in order, ready to copy When to use it. Print only the commands, in order, ready to paste. Use it to build a runbook, to script a job that is done the same way every time, or to check a script somebody else wrote actually follows the procedure. |
--standards | Show the published practice each step comes from When to use it. Show the published practice each stage comes from - ISO/IEC 27037, NIST SP 800-86, the ACPO principles. Use it when a client, an auditor or a court asks why a step exists, and when training staff who need to know the procedure is not this vendor's opinion. |
recoveryantra view
<view_command> | When to use it. Open an artefact in a structured viewer without leaving the case: `registry` browses a hive, `plist` shows a property list, `sqlite` browses a database and its deleted rows, `hex` pages raw bytes, `interpret` decodes the bytes at an offset, `bookmark` marks bytes on the case. Every view prints JSON. |
|---|
recoveryantra which
<situation> | What is happening, in plain words (e.g. "drive is clicking"); omit to list every situation When to use it. Describe what is happening in your own words - "drive is clicking", "formatted the wrong disk", "Outlook will not open it" - and get the feature to use, why that one rather than the obvious alternative, a worked example, the commands, and what NOT to do. Use it when somebody hands you a job and you are not sure which part of the product it belongs to, and give it to new staff before you give them anything else. |
|---|---|
--all | Show every situation, grouped, rather than searching When to use it. List every situation, grouped, instead of searching. Use it to see the whole range at once - useful when scoping what a product will cover for a customer, and for training. What it costs. Situations the product you are running does not include are marked, so the list stays honest about what this build can actually do. |