Choose for compatibility or resilience.
Folder and stream modes converge on a final archive, but they differ in peak disk use and when evidence enters that archive.
Collection mode comparison
| Property | Folder mode | Stream mode |
|---|---|---|
| Enable | Default unless profile sets stream: true | --stream or profile setting |
| Writes during acquisition | Intermediate directory tree | Directly into archive entries |
| Peak working disk | Artifact folder + final archive during compression | Primarily the growing archive |
| Configuration placement | Saved in the intermediate folder | Written as an archive entry at initialization |
| Cleanup | Intermediate directory removed after compression | Leftover tool-output paths removed after finalization |
Format comparison
.zip
ZIP + Deflate
Best general compatibility. Entries use Deflate and large-file support. When a password is supplied, Aralez configures AES-256 encryption for ZIP entries.
- Broad analyst-tool support
- Optional archive encryption
- Requires proper writer finalization
.tar.zst
TAR + Zstandard
Best operational resilience. The writer appends TAR entries through a level-3 Zstandard encoder and is the documented crash-tolerant option.
- Fast compression/decompression
- Append-oriented archive structure
- No archive-password path in current implementation
Encryption applies to ZIP
--encrypt changes ZIP writer options. The current TAR.ZST initialization does not use the archive password, so do not rely on --encrypt to encrypt TAR.ZST output. Use encrypted storage or a separate approved envelope if TAR evidence must be encrypted at rest.
Archive structure
▾Aralez_HOST_2026-08-14_16-22-09/
◇
config.yml◇
Aralez_HOST_2026-08-14_16-22-09.log▾tools/
◇
ProcInfo.csv◇
Network.csv▾device-or-drive/
◇
… configured artifactsGraceful stop sequence
Ctrl + Cfirst pressSet interrupt flag
→between tasksStop acquisition
→writer finishFinalize archive