Forensic Analysis Reference
Detailed CLI reference for volatile state, memory dumps, file analysis, and forensic inventory.
All commands require agent mode (--agent). For scheduling, see Incident Forensics.
export volatile
reel --agent export volatile --pod <pod> [--container <container>] -n <namespace> [-o <file>]
Runtime state: process tree, open file descriptors, network connections, memory maps, and environment variables.
| Flag | Description | Default |
|---|---|---|
| -o, --output | Destination file | stdout |
| -f, --format | Output format: json, yaml | json |
export metadata
reel --agent export metadata --pod <pod> [--container <container>] -n <namespace> [-o <file>]
Container configuration, image info, resource limits, environment variables, and volume mounts.
| Flag | Description | Default |
|---|---|---|
| -o, --output | Destination file | stdout |
| -f, --format | Output format: json, yaml | json |
export memory
reel --agent export memory --pod <pod> [--container <container>] -n <namespace> [-o <file>]
GDB-compatible ELF core dump. Uses gcore when available, falls back to /proc/mem. Compressed with zstd by default (~60% size reduction).
| Flag | Description | Default |
|---|---|---|
| -o, --output | Destination file | auto |
| --compress | Compression: none, fast, default, better, best | default |
list files / export files
# List files (query)
reel --agent list files --pod <pod> --path <path> -n <namespace> [flags]
# Export files (archive)
reel --agent export files --pod <pod> --path <path> -n <namespace> -o <file>
| Flag | Description |
|---|---|
| -r, --recursive | Include subdirectories |
| --modified-since | Modified after time (e.g., 1h, 24h, 7d) |
| --modified-before | Modified before time |
| --suid | Filter for SUID bit |
| --sgid | Filter for SGID bit |
| --hash | Calculate file hashes (SHA-256) |
| --show-hidden | Include hidden files |
| --include / --exclude | Glob patterns for filtering |
| --min-size / --max-size | Size filters (e.g., 1KB, 10MB) |
export inventory
reel --agent export inventory --pod <pod> --path <path> -n <namespace> --hash [-o <file>]
Forensic file inventory in CycloneDX 1.6 format. Includes cryptographic hashes, permissions, timestamps, and optional chain-of-custody metadata.
| Flag | Description |
|---|---|
| -o, --output | Destination file |
| -f, --format | Output format: json, xml |
| --chain-of-custody | Include extended forensic metadata |
| --hash | Calculate file hashes |
| --diff-only | Scan only diff layer (zero-copy) |
| --from-layer | Scan stored layer by ID |
See Incident Forensics for scheduling and use case examples.