UAC is a Live Response collection tool for Incident Response that makes use of built-in tools to automate the collection of Unix-like systems artifacts. It respects the order of volatility and artifacts that are changed during the execution. It was created to facilitate and speed up data collection, and depend less on remote support during incident response engagements.
UAC can also be run against mounted forensic images. Please take a look at the conf/uac.conf file for more details.
You can use your own validated tools during artifact collection. They will be used instead of the built-in ones provided by the target system. Please refer to bin/README.txt for more information.
Supported Systems
Collectors
Collect information, calculate MD5 hash, and extract strings from running processes.
Collect active network connections with related process information.
Collect user accounts information, login related files, and activities. The list of files and directories that will be collected can be found in the conf/user_files.conf file.
Collect system information, system configuration files, and kernel related details. The list of files and directories that will be collected can be found in the conf/system_files.conf file.
Collect low-level hardware information.
Collect information about installed packages and software.
Collect information about disks, volumes, and file systems.
Collect docker and virtual machines’ information.
Extract information from files and directories using the stat or stat.pl tool to create a body file. The body file is an intermediate file when creating a timeline of file activity. It is a pipe (“|”) delimited text file that contains one line for each file. Plaso or mactime tools can be used to read this file and sorts the contents.
Collect log files and directories. The list of files and directories that will be collected can be found in the conf/logs.conf file.
Collect suspicious files and directories. The list of files and directories that will be collected can be found in the conf/suspicious_files.conf file.
Extensions
Run chkrootkit tool (if available). Note that chrootkit tool is not provided by UAC. You need to either have it available on the target system or download and compile it, and make its static binary file available through bin directory. Please refer to bin/README.txt for more information.
Run Sleuth Kit fls tool (if available) against all mounted block devices. Note that fls tool is not provided by UAC. You need to either have it available on the target system or download and compile it, and make its static binary file available through bin directory. Please refer to bin/README.txt for more information.
Collect MD5 hashes for all executable files. By default, only files smaller than 3072000 bytes (3MB) will be hashed. Please take a look on the extensions/hash_exec/hash_exec.conf file more details. Warning: this extension will change the last accessed date of the touched files.
Profiles
One of the following profiles will be selected automatically according to the kernel name running on the current system. You can manually select one using the -P option though. This is useful when either UAC was not able to identify the correct profile for the current running system or when you are running UAC against a mounted forensic image.
Use this profile to collect AIX artifacts.
Use this profile to collect BSD-based systems artifacts.
e.g. FreeBSD, NetBSD, OpenBSD, NetScaler…
Use this profile to collect Linux-based systems artifacts.
*e.g. Debian, Red Hat, SuSE, Arch Linux, OpenWRT, QNAP QTS, Linux running on top of Windows (WSL)…
Use this profile to collect macOS artifacts.
Use this profile to collect Solaris artifacts.
Options
The range of dates to be used during logs, suspicious files, user files, and hash executable files collection. The date range is used to limit the amount of data collected by filtering files using find’s -atime, -mtime or -ctime parameter. By default, UAC will search for files that data was last modified (-mtime) OR status last changed (-ctime) within the given date range. Please refer to conf/uac.conf for more details. The standard format is YYYY-MM-DD for a starting date and no ending date. For an ending date, use YYYY-MM-DD..YYYY-MM-DD.
Transfer the output file to a remote server using scp. The destination must be specified in the form [user@]host:[path]. It is recommended to use SSH key authentication in order to automate the transfer and avoid any password prompt during the process.
Increase debugging level.
Increase verbosity level.
Allow UAC to be run by a non-root user. Note that data collection will be limited.
Configuration Files
The main UAC configuration file.
Directory or file paths that will be searched and collected by the logs (-l) collector. If a directory path is added, all files and subdirectories will be collected automatically. The find command line tool will be used to search for files and directories, so the patterns added to this file need to be compatible with the -name option. Please check find man pages for instructions.
Directory or file paths that will be searched and collected by the suspicious files (-f) collector. If a directory path is added, all files and subdirectories will be collected automatically. The find command line tool will be used to search for files and directories, so the patterns added to this file need to be compatible with the -name option. Please check find man pages for instructions.
Directory or file paths that will be searched and collected by the system files (-y) collector. If a directory path is added, all files and subdirectories will be collected automatically. The find command line tool will be used to search for files and directories, so the patterns added to this file need to be compatible with the -name option. Please check find man pages for instructions.
Directory or file paths that will be searched and collected by the user files (-u) collector. If a directory path is added, all files and subdirectories will be collected automatically. The find command line tool will be used to search for files and directories, so the patterns added to this file need to be compatible with the -name option. Please check find man pages for instructions.
Directory or file paths that will be excluded from the collection. If a directory path is added, all files and subdirectories will be skilled automatically. The find command line tool will be used to search for files and directories, so the patterns added to this file need to be compatible with -path and -name options. Please check find man pages for instructions.
Usage
UAC (Unix-like Artifacts Collector)
Usage: ./uac COLLECTORS [-e EXTENSION_LIST] [-P PROFILE] [OPTIONS] [DESTINATION]
COLLECTORS:
-a Enable all collectors.
-p Collect information, calculate MD5 hash, and extract strings from running processes.
-n Collect active network connections with related process information.
-u Collect user accounts information, login related files, and activities.
-y Collect system information, system configuration files, and kernel related details.
-w Collect low-level hardware information.
-s Collect information about installed packages and software.
-d Collect information about disks, volumes, and file systems.
-k Collect docker and virtual machines information.
-b Extract information from files and directories using the stat tool to create a body file.
-l Collect log files and directories.
-f Collect suspicious files and directories.
EXTENSIONS:
-e EXTENSION_LIST
Comma-separated list of extensions.
all: Enable all extensions.
chkrootkit: Run chkrootkit tool.
fls: Run Sleuth Kit fls tool.
hash_exec: Hash executable files.
PROFILES:
-P PROFILE Force UAC to use a specific profile.
aix: Use this one to collect AIX artifacts.
bsd: Use this one to collect BSD-based systems artifacts.
linux: Use this one to collect Linux-based systems artifacts.
macos: Use this one to collect macOS artifacts.
solaris: Use this one to collect Solaris artifacts.
OPTIONS:
-R Starting date YYYY-MM-DD or range YYYY-MM-DD..YYYY-MM-DD
-T DESTINATION
Transfer output file to a remote server using scp.
The destination must be specified in the form [user@]host:[path]
-D Increase debugging level.
-V Increase verbosity level.
-U Allow UAC to be run by a non-root user. Note that data collection will be limited.
-v Print version number.
-h Print this help summary page.
DESTINATION:
Specify the directory the output will be saved to.
The default is the current directory.
Output
When UAC finishes, all collected data is compressed and the resulting file is stored in the destination directory. The compressed file is hashed (MD5) and the value is stored on a .md5 file.
Examples
Run all collectors against the current running system and use the current directory as the destination. Extensions will not be run:
./uac -a
Run all collectors and all extensions against the current running system, and use /tmp as the destination directory:
./uac -a -e all /tmp
Run only hash_exec and chkrootkit extensions against the current running system, force linux profile and use /mnt/share as the destination directory:
./uac -e hash_exec,chkrootkit -P linux /mnt/share
Run only process, hardware and logs collectors against the current running system, force solaris profile, use /tmp as the destination directory, and increase verbosity level:
./uac -p -w -l -P solaris -V /tmp
PHP 8.5 is included in Ubuntu 26.04's default repositories and is the recommended version for…
Ubuntu 26.04 LTS "Resolute Raccoon" arrived on April 23, 2026 with Linux kernel 7.0, GNOME 50,…
Kubernetes is the standard platform for running containerized workloads across multiple servers with self-healing, rolling…
Ubuntu 26.04 LTS "Resolute Raccoon" was released on April 23, 2026 with Linux kernel 7.0, GNOME desktop, and standard security support until April 2031. A clean install gives you a known-good starting point on new hardware, when replacing another operating system, or when an upgrade path is not practical. This guide walks through how to install Ubuntu 26.04: downloading and verifying the ISO, writing a bootable USB drive, completing the installer, and doing the initial setup after the first boot. Before you start: You need a USB drive with at least 12 GB of free space. Back up any existing data on the target machine — the installer can erase the entire disk. Install Ubuntu 26.04: Download the ISO…
The correct timezone affects more than the clock on your screen. It drives cron job scheduling, systemd timer execution, log file timestamps, database record timing, and SSL certificate validity checks. A mismatched timezone can cause scheduled jobs to fire at the wrong hour and make log timestamps impossible to match with real-world events. This guide shows how to change timezone on Ubuntu using the timedatectl command (the recommended approach for servers and remote machines) and through the graphical Date & Time settings on desktop systems. The steps apply to all current Ubuntu releases including 24.04 and 26.04. <strong>Prerequisite:</strong> Only the root user or a user with sudo access can change the system timezone. Check the Current Timezone Before You Change It Run timedatectl with no arguments to see the active timezone and clock status: bashtimedatectl Sample output: Local…
Atom is a free, open-source, cross-platform code editor developed by GitHub. Built on Electron, it uses…