File formats
| File | Format | Notes |
|---|---|---|
*.pcap |
Standard pcap | Opens in Wireshark or any pcap tool. Each frame up to 65,535 bytes. Never modified by Antinomie. |
telemetry.raw |
Length-prefixed packets | Each recorded telemetry packet is preceded by its length as a little-endian 32-bit integer. Written by Antinomie; read it through the app. |
objects/objects-NNNNNN.seg, objects.idx |
Append-only packs | Captured buffers. Identical chunks in one archive are stored once. Older recordings used one .raw file per buffer. |
triage-events.jsonl |
JSON Lines | The Sigma event journal. First line a header with "kind":"header", "format_version":3 and the run’s identity; then one "kind":"event" line per event with a category, fields, an evidence link, a time and, when some fields were inferred, an _inferred list; ends with a "kind":"end" record with the event count, the number omitted and whether the journal is complete. Journals of format 1 and 2 still open and scan. |
triage-findings-v1.jsonl |
JSON Lines | The findings of the latest Triage scan of a run: one line per finding with "format_version":1, the evidence_call_id of the call it came from and its facts. Replaced as a whole by the next scan; at most 256 MiB. |
triage-detection/*/report.json |
JSON | One detection report per engine: sources, versions, rule selection digest, licenses, coverage, scanned inputs and matches, with explicit count fields (format_version 1, coverage) |
process.elf, the run’s core |
ELF | A native Linux x86-64 ELF core. Thread registers and mappings in standard notes; unavailable memory has p_filesz of zero. Memory that was never touched is a hole in a sparse file, so the file’s length can be much larger than the bytes on disk. |
memory.elf |
ELF | The VM’s physical RAM as written by QEMU |
root.ext4 |
Raw ext4 image | A disk dump from the Disks tab: a standalone, sparse filesystem image. Mount it read-only or open it with any ext4 tool. |
<capture>.pcap.view/ |
Cache | The packet list TShark parsed for a finished capture (meta.json, rows.tsv). It is used again only for the same capture size and time and the same TShark version, rebuilt otherwise, and deleted with the capture. |
properties.json |
JSON | Hashes, file identification and fuzzy hashes of the retained executable |
run.json, manifest.json, artifacts.json |
JSON | Recorder-owned metadata about the run |
core.json, dump.json |
JSON | Identity, sizes, hashes and outcome of a core or a memory dump |
disks/<id>/dump.json |
JSON | A disk dump’s record: VM, source (current disk, checkpoint, base or imported image) with its layers, time, clean or not cleanly unmounted, logical and allocated size, and SHA-256 when it was hashed. A folder without it is not a dump. |
capture.json, processes.json |
JSON | A Capture all summary and its process tree |
annotation.json |
JSON | Your name and tags |
| Volatility results | Volatility’s own output | Saved with the dump they came from |
Reports, evidence and samples New in 0.8.0
Section titled “Reports, evidence and samples ”| File | Format | Notes |
|---|---|---|
antinomie-report-RUN-TIME.html |
HTML | One self-contained file: inline CSS, no script, no external reference; also well-formed XML. See Report export. |
antinomie-report-RUN-TIME.pdf |
A4 landscape, bookmarks per section, standard Helvetica and Courier fonts, no embedded font. Characters outside Latin-1 print as ?. |
|
antinomie-report-RUN-TIME.json |
JSON | "schema": "antinomie-triage-report", "schema_version": 1, following the JSON Schema (2020-12) triage-report-schema-1.json. A section you did not choose is null. Read with unknown fields ignored. |
antinomie-report-RUN-TIME.misp.json |
MISP core format | One unpublished event ({"Event": {...}}), distribution 0, with attributes and ATT&CK galaxy tags |
antinomie-report-RUN-TIME.stix.json |
STIX 2.1 bundle | Identity, file, malware, malware-analysis, indicators, attack patterns and relationships; ids derived from the content |
…-evidence.zip |
Zip | Not encrypted. capture/ (pcaps), dropped-files.zip, custody/, manifest.json and manifest.sha256 |
dropped-files.zip |
Zip, AES-256 (WinZip AE-2) | Password infected. SHA256.bin per file and files.json mapping each to its guest path. Opens with 7-Zip, p7zip, WinZip or pyzipper, not Info-ZIP unzip or Python’s zipfile. |
manifest.sha256 |
sha256sum -c |
Check an extracted bundle with sha256sum -c manifest.sha256 |
custody-NAME-SHA8.json |
JSON | A custody record: "format": "antinomie-custody-record", the entries and hashes as stored, the library index records about the sample, and the check at export time. See Custody log. |
custody-NAME-SHA8.html |
HTML | The same record as a readable page with the JSON embedded |
verify-custody.py |
Python 3 | Written beside a JSON record; standard library only. Exit 0 verified, 1 not verified, 2 unreadable. |
….minisig, ….sig |
minisign, SSH signature | Your own signature of an exported record (SSH namespace antinomie-custody) |
reconstructed/NAME.bin, .mask |
Raw bytes | A saved file reconstruction: unknown bytes as 00; the mask has one byte per file byte, 00 known, 01 unknown, 02 not captured, 03 mapping |
file-before/ |
Blobs and index.json |
In a boot’s recording: the earlier bytes of the files its runs changed, within the caps in Settings › Advanced |
triage-digest.json |
JSON | In a run’s folder: what Triage found (highest tier, rules, techniques, evasion checks, detection matches, indicators, lineage), so the sample window can add runs up. Written when Triage reads a finished run. |
samples/library.sqlite |
SQLite | The sample library: names, descriptions, tags, origins, what was sent where, and the custody log chains |
samples/XX/SHA256.zip |
Zip, AES, password infected |
One archive per sample, in a folder named after the first two hex digits of its SHA-256. Owner-only. |
samples/legacy/ |
JSON | The records of earlier versions, kept after they were moved into the library |
JSON files are written atomically, so you will not see half-written ones. Some small JSON files are published by a background writer a moment after the event they describe.
Process cores in the run record
Section titled “Process cores in the run record”A run’s artifacts.json says what became of its network capture and core,
including when you deleted them. For a core it records the budget that was
requested, the one the guest accepted, the size the ELF file declares, the
bytes saved and the file’s logical size, and, for a partial core, why it is
incomplete (budget reached, guest memory, deadline, recording quota, host disk,
canceled and so on). A manual core’s core.json records its requested and
accepted budget, the bytes stored, the declared and allocated size and the
reason in the same way.
The event journal in detail
Section titled “The event journal in detail”triage-events.jsonl is derived from the syscall trace, the kernel’s
credential, hash and file records and, for DNS and HTTP, from the packets
TShark parsed, so it is a convenience view and not a second source of truth.
Each event names the exact call or packet it came from, and the
viewer shows that link. Fields that were not
captured are absent from an event; they are not set to empty values. Format 3
adds User, LogonId, Hashes and HashSkipped and the auditd id fields
where a base built for Antinomie 0.7.0 recorded them; journals of a recording
made before that simply lack those fields. A run split across transport
reconnects has one journal, in its newest segment.
Stability
Section titled “Stability”Files are versioned where they need to be, and older recordings stay readable. Treat undocumented fields as internal. If you build tools on these files, rely on the ones above and check each file’s format version.