Evidence routing

Deliver the finalized archive.

Aralez creates the archive locally first, then dispatches it to a CLI destination or each YAML-configured destination.

i

Archive first, upload second

The current upload path does not stream evidence directly from collection into a remote service. Aralez finalizes a local archive, then uploads or copies that file.

Destination reference

Destination	CLI form	Build/runtime requirement	Authentication
Folder	`D:\Evidence` or `/mnt/evidence`	None	Operating-system permissions
SMB	`smb://server/share/path`	Windows: `net use` + `copy`; Unix: `smbclient`	YAML supports user/password/domain; CLI URL does not
SFTP	`sftp://user@host:22/path`	`upload-sftp`	CLI URL uses SSH agent; YAML can supply password or key path
S3 / MinIO	`s3://bucket/prefix`	`upload-s3`	CLI, YAML, AWS credential chain, or workload identity

Examples

PowerShell · Run as Administrator

# Local or mounted folder
aralez.exe -o D:\Evidence\Incoming

# SFTP through the SSH agent
aralez.exe -o sftp://forensic@collector.internal:22/incoming

# SMB URL
aralez.exe -o smb://fileserver/forensics/incoming

# AWS S3 through the default credential chain
aralez.exe -o s3://forensic-bucket/incoming

# MinIO / S3-compatible storage
aralez.exe -o s3://forensic-bucket/incoming `
  --s3-endpoint https://minio.internal:9000 `
  --s3-access-key $env:ARALEZ_S3_KEY `
  --s3-secret-key $env:ARALEZ_S3_SECRET

bash

# Mounted/NFS/local folder
sudo aralez -o /mnt/evidence/incoming

# SFTP through the SSH agent
sudo aralez -o sftp://forensic@collector.internal:22/incoming

# SMB URL
sudo aralez -o smb://fileserver/forensics/incoming

# AWS S3 through the default credential chain
sudo aralez -o s3://forensic-bucket/incoming

# MinIO / S3-compatible storage
sudo aralez -o s3://forensic-bucket/incoming \
  --s3-endpoint https://minio.internal:9000 \
  --s3-access-key "$ARALEZ_S3_KEY" \
  --s3-secret-key "$ARALEZ_S3_SECRET"

Precedence

CLI --output replaces YAML destination dispatch for that run. Only one parsed CLI destination is used.
Without --output, all YAML destinations are attempted. Individual failures are logged and iteration continues.
CLI S3 endpoint and credentials override YAML values. Otherwise the AWS SDK credential chain applies when explicit values are absent.

Post-delivery cleanup

Run form	Local archive after successful dispatch
No CLI `--output`	Kept, even when YAML destinations are configured
Remote CLI URI	Removed
CLI folder different from archive directory	Copied to destination, then source archive removed
CLI folder resolves to archive directory	Kept

!

Successful dispatch controls deletion

The cleanup step runs only after upload::dispatch returns successfully. Test destination permissions, available capacity, object naming, retention, and monitoring before relying on automated local cleanup.

Minimal S3 intent

Use a dedicated write-only principal scoped to the evidence prefix. A baseline policy should allow only s3:PutObject on the intended path; adapt it to your retention and encryption requirements.

JSON

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::forensic-bucket/incoming/*"
  }]
}

NextDestination cookbook→