Folder · SMB · SFTP · S3

Route triage data to the right evidence store.

Use a CLI destination for a single, fail-closed handoff or embed multiple YAML destinations when you need fan-out with a retained local copy.

Choose the delivery model

Need	Recommended destination	Why	Important limitation
Keep evidence on another local/mounted volume	Folder path	No optional build feature; ordinary filesystem copy	The destination is only as reliable and secure as its mount/session.
Windows file-server workflow	UNC folder path or `smb://`	Works with enterprise shares and current Windows credentials	CLI SMB URL cannot carry credentials.
Authenticated SSH collector	SFTP	Encrypted transport; agent, key, or password authentication	Remote directory must already exist; host-key verification is not implemented in the uploader.
Durable object storage	S3	Prefix isolation, retention controls, scalable central ingest	Requires an `upload-s3` build and correct credential/region policy.
On-prem object storage	MinIO / S3-compatible	Same `s3://` model with a custom endpoint	Custom endpoints force path-style requests; validate TLS trust.
Send to several stores and preserve source	YAML `output.destinations`	Sequential fan-out and local retention	Destination failures are logged but do not make dispatch return an error.

Build a routing command

Endpoint platform Destination type Destination

One-run CLI override

aralez.exe --stream --output "D:\Evidence\Incoming"

Persistent profile fragment

output:
  destinations:
    - type: folder
      path: "D:\\Evidence\\Incoming"

The builder generates syntax, not credentials or policy. Validate the route on a canary endpoint and confirm the receiver’s hash/size before production use.

Folder, mounted drive, UNC, and mapped drive

Any --output value without a recognized URI scheme is parsed as a folder. Aralez creates the destination directory, copies the finalized archive into it, and reports an error if directory creation or copying fails.

PowerShell

# Local evidence volume
aralez.exe --stream --output "D:\Evidence\Incoming"

# UNC share using the process token/current network session
aralez.exe --stream --output "\\fileserver\forensics\incoming"

# Existing mapped drive
aralez.exe --stream --output "Z:\incoming"

# Relative folder: resolved under --workdir
aralez.exe --workdir "D:\Cases\IR-2042" --output "outgoing"

shell

# Local, NFS, CIFS, or removable mount
sudo aralez --stream --output "/mnt/evidence/incoming"

# Relative to the selected working directory
sudo aralez --workdir "/var/tmp/ir-2042" --output "outgoing"

If the CLI folder differs from the archive’s current directory, the copy is created and the source archive is deleted after success.
If it resolves to the current archive directory, the archive is already in place and is retained.
A YAML folder destination is copied but the local archive is always retained.
Drive mappings are session-specific. A service, scheduled task, SCCM, or WinRM process may not see the operator’s interactive mapped drive; prefer a UNC path.

SMB URL

PowerShell

# CLI: current process/session credentials
aralez.exe --output "smb://fileserver/forensics/incoming"

# YAML: optional explicit credentials
output:
  destinations:
    - type: smb
      share: "//fileserver/forensics/incoming"
      username: "FORENSICS\\aralez-writer"
      password: "replace-through-secure-build-process"

YAML

output:
  destinations:
    - type: smb
      share: "//fileserver/forensics/incoming"
      domain: "FORENSICS"
      username: "aralez-writer"
      password: "replace-through-secure-build-process"

Windows implementation

When YAML credentials exist, Aralez invokes net use, then copies with cmd /C copy /Y. The separate domain field is not used on Windows; place the domain in username as DOMAIN\user. A failed net use is logged as a warning because an existing session may still work.

Linux/macOS implementation

Requires smbclient. With no CLI credentials it uses anonymous/no-password mode. YAML can supply domain/user/password. Nested subdirectories are created with SMB mkdir commands before put.

!

Do not put passwords in routine command lines

CLI URLs deliberately have no SMB password field. YAML secrets become embedded in the generated executable and can be recovered by anyone with access to it. Prefer a constrained machine/service identity or a short-lived staging process.

SFTP

PowerShell · agent authentication

# Port defaults to 22; remote path defaults to /
aralez.exe --output "sftp://forensic@collector.internal:22/incoming"

# Verify the agent context before collection
ssh-add -l

YAML · key authentication

output:
  destinations:
    - type: sftp
      host: "collector.internal"
      port: 22
      username: "forensic"
      key_path: "/root/.ssh/aralez_ed25519"
      remote_path: "/incoming"

Authentication order is key_path, then password, then SSH agent. A CLI SFTP URI carries neither key nor password, so it uses the agent.
The file is uploaded in 8 MiB chunks. Its remote name is the local archive filename.
The remote directory is not created by Aralez; provision remote_path and permissions beforehand.
The uploader establishes an SSH session but does not perform a known-hosts/host-key verification step. Use only in a controlled network or add verification before treating this transport as strongly authenticated.

AWS S3 and S3-compatible storage

PowerShell

# AWS SDK credential/region chain
aralez.exe --output "s3://forensic-bucket/incidents/IR-2042"

# MinIO using process-environment secrets
aralez.exe --output "s3://forensic-bucket/incidents/IR-2042" `
  --s3-endpoint "https://minio.internal:9000" `
  --s3-access-key $env:ARALEZ_S3_KEY `
  --s3-secret-key $env:ARALEZ_S3_SECRET

shell

sudo aralez --output "s3://forensic-bucket/incidents/IR-2042"

sudo --preserve-env=ARALEZ_S3_KEY,ARALEZ_S3_SECRET aralez \
  --output "s3://forensic-bucket/incidents/IR-2042" \
  --s3-endpoint "https://minio.internal:9000" \
  --s3-access-key "$ARALEZ_S3_KEY" \
  --s3-secret-key "$ARALEZ_S3_SECRET"

YAML

output:
  destinations:
    - type: s3
      bucket: "forensic-bucket"
      prefix: "incidents/IR-2042"
      region: "eu-west-1"

    - type: s3
      bucket: "forensic-backup"
      prefix: "incoming"
      endpoint: "https://minio.internal:9000"
      access_key: "optional-explicit-key"
      secret_key: "optional-explicit-secret"

Object key

The key is prefix/archive-filename; with no prefix it is just the filename. The bucket must already exist.

Credentials

Explicit credentials are used only when both access and secret values are present. Otherwise the AWS SDK default chain applies. CLI values override YAML values.

Region

The CLI URI has no region component. Supply region in YAML or through the SDK environment/profile/instance-identity chain.

Custom endpoint

An endpoint enables S3-compatible service access and forces path-style bucket requests. Use a certificate trusted by the endpoint host.

Complete multi-destination profile

Destinations are attempted sequentially in listed order. One failure is logged and does not stop later entries. The original archive remains beside Aralez regardless of individual destination results.

YAML · all destination types

output:
  destinations:
    # 1. Local staging copy
    - type: folder
      path: "D:\\Evidence\\Staging"

    # 2. Windows/Unix SMB receiver
    - type: smb
      share: "//fileserver/forensics/incoming"
      username: "FORENSICS\\aralez-writer"
      password: "replace-through-secure-build-process"

    # 3. SSH evidence receiver
    - type: sftp
      host: "collector.internal"
      port: 22
      username: "forensic"
      key_path: "C:\\ProgramData\\Aralez\\keys\\writer"
      remote_path: "/incoming"

    # 4. Object-storage copy
    - type: s3
      bucket: "forensic-bucket"
      prefix: "incoming"
      region: "eu-west-1"

CLI versus YAML semantics

Property	CLI `--output`	YAML destinations
Destination count	Exactly one parsed destination	Zero or more, attempted sequentially
Precedence	Skips the entire YAML destination list	Used only when CLI output is absent
Failure	Propagates and makes the run fail	Logged; iteration continues; dispatch returns success
Successful remote dispatch	Local source archive removed	Local source archive kept
Successful different-folder dispatch	Copied, then local source removed	Copied and local source kept
Secrets	May be exposed through process inspection/history; S3 only	Become part of the embedded config and archived `config.yml`

Receiver verification checklist

✓
Arrival. Expected object/file exists under the intended case prefix and has a non-zero, plausible byte size.
✓
Integrity. Receiver SHA-256 matches a hash captured before dispatch or immediately after local retention.
✓
Completeness. Archive listing opens and includes config.yml, the run log, and expected platform folders.
✓
Uniqueness. Object naming cannot overwrite another host/run; use case/host prefixes and isolated work directories.
✓
Protection. Transport authentication, encryption at rest, write-only endpoint identity, retention lock, monitoring, and analyst access are enforced externally.

NextFleet deployment→