A profile is an executable plan.
Aralez loads its embedded YAML, sorts tasks by priority, verifies resources, and runs collection and execution tasks into a shared output target.
Run lifecycle
- 01
Privilege gate
Linux and macOS require effective UID 0. Windows expects an Administrator context.
- 02
Configuration load
Load the embedded profile, apply CLI encryption/stream/compression overrides, expand output filename variables, and set global state.
- 03
Resource gate
Verify the platform memory check and current disk-capacity threshold before creating output and again before each task.
- 04
Output initialization
Create a folder, ZIP writer, or TAR + Zstandard writer. In stream mode, write
config.ymlimmediately. - 05
Ordered tasks
Sort tasks by ascending
priority; skip disabled tasks; execute groups within execution tasks in parallel. - 06
Finalize and deliver
Add the log, finish the archive, remove intermediate files, dispatch configured uploads, and apply post-upload cleanup.
Task types
Filesystem acquisition
Builds a tree from configured roots and glob patterns, selects a filesystem explorer, and copies matching files while applying size policy. The NTFS reader can also encrypt selected entries.
- Raw NTFS or ext4 readers where available
- Native POSIX fallback on mounted filesystems
- All-drive mode on Windows with exclusions
Live and tool output
Runs entries classified as internal, system, or external and writes captured output to the configured output file. Entry groups execute with Rayon parallelism.
- Internal Rust collectors
- Commands already on the OS
- Embedded Windows executables
Filesystem selection
The reader checks filesystem signatures from the selected device. Linux can parse ext4 or NTFS directly and falls back to native traversal when a path is mounted, unreadable as a block device, or an ext4 journal layout is incompatible. macOS intentionally uses mounted-filesystem traversal in the current flow because SIP restricts raw device access.
Drive selection
| Platform | Default | --default_drive value |
|---|---|---|
| Windows | C | Drive letter without colon |
| Linux | Root block device from mount info, otherwise / | Device path or mounted path, such as /dev/sda2 |
| macOS | Root device basename from mount | Device basename such as disk3s4s1 |
Interrupt behavior
A global Ctrl+C handler changes the first interrupt into a graceful shutdown request. The main task loop checks this flag between tasks, then finalizes the archive with everything already collected. A second Ctrl+C exits immediately with status 1. TAR.ZST is the more interruption-tolerant format, but no format can guarantee preservation after forced process termination, power loss, or storage failure.