LEAF_master.py [-h] [-i INPUT [INPUT ...]] [-o OUTPUT] [-u USERS [USERS ...]] [-c CATEGORIES [CATEGORIES ...]] [-v]                      [-s] [-g [GET_FILE_BY_OWNER [GET_FILE_BY_OWNER ...]]] [-y [YARA [YARA ...]]]                      [-yr [YARA_RECURSIVE [YARA_RECURSIVE ...]]] [-yd [YARA_DESTINATIONS [YARA_DESTINATIONS...]]]LEAF (Linux Evidence Acquisition Framework) - Cartware     ____        _________    ___________   __________     /   /       /   _____/   /  ____    /  /   ______/   /   /       /   /____    /  /___/   /  /   /____    /   /       /   _____/  /   ____    /  /   _____/ /   /_____  /   /_____  /   /   /   /  /   /      /_________/ /_________/ /___/   /___/  /___/          v2.0

optional arguments:  -h, --help            show this help message and exit  -i INPUT [INPUT ...], --input INPUT [INPUT ...]                        Additional Input locations. Separate multiple input files with spaces                        Default: /home/user1/Desktop/LEAF-3/target_locations			  -o OUTPUT, --output OUTPUT                          Output directory location			                        Default: ./LEAF_output			  -u USERS [USERS ...], --users USERS [USERS ...]                          Users to include in output, separated by spaces (i.e. -u alice bob root).                         Users not present in /etc/passwd will be removed                        Default: All non-service users in /etc/passwd  -c CATEGORIES [CATEGORIES ...], --categories CATEGORIES [CATEGORIES ...]<   br/>                        Explicit artifact categories to include during acquisition.                         Categories must be separated by space, (i.e. -c network users apache).                        Full List of built-in categories includes:                        	APPLICATIONS, EXECUTIONS, LOGS, MISC, NETWORK, SHELL, STARTUP, SERVICES, SYSTEM, TRASH, USERS                        Categories are compatible with user-inputted files as long as they follow the notation:                        	# CATEGORY                        	/location1                        	/location2                         	.../location[n]                        	# END CATEGORY                         Default: "all"  -v, --verbose         Output in verbose mode, (may conflict with progress bar)                        Default: False  -s, --save            Save the raw evidence directory                        Default: False  -g [GET_   OWNERSHIP [GET_OWNERSHIP ...]], --get_ownership [GET_OWNERSHIP [GET_OWNERSHIP ...]]                        Get files and directories owned by included users.                        Enabling this will increase parsing time.                        Use -g alone to parse from / root directory.                        Include paths after -g to specify target locations (i.e. "-g /etc /home/user/Downloads/                        Default: Disabled  -y [YARA [YARA ...]], --yara [YARA [YARA ...]]                        Configure Yara IOC scanning. Select -y alone to enable Yara scanning.                        Specify '-y /path/to/yara/' to specify custom input location.                        For multiple inputs, use spaces between items,                        i.e. '-y rulefile1.yar rulefile2.yara rule_dir/'                        All yara files m   ust have ".yar" or ".yara" extension.                        Default: None  -yr [YARA_RECURSIVE [YARA_RECURSIVE ...]], --yara_recursive [YARA_RECURSIVE [YARA_RECURSIVE ...]]                        Configure Recursive Yara IOC scanning.                        For multiple inputs, use spaces between items,                        i.e. '-yr rulefile1.yar rulefile2.yara rule_dir/'.                        Directories in this list will be scanned recursively.                        Can be used in conjunction with the normal -y flag,                        but intersecting directories will take recursive priority.                        Default: None  -yd [YARA_DESTINATIONS [YARA_DESTINATIONS...]], --yara_destinations [YARA_DESTINATIONS [YARA_DESTINATIONS...]]                        Destination to run yara files against.                         Separate multiple targets with a space.(i.e. /home/alice/ /bin/star/)                           Default: All user directories

To use default arguments [this will use default input file (./target_locations), users (all users), categories (all categories), and output location (./LEAF_output/). Cloned data will not be stored in a local directory, verbose mode is off, and yara scanning is disabled]:	LEAF_main.pyAll arguments:	LEAF_main.py -i /home/alice/Desktop/customfile1.txt -o /home/alice/Desktop/ExampleOutput/ -c logs startup services apache -u alice bob charlie -s -v -y /path/to/yara_rule1.yar -yr /path2/to/yara_rules/ -yd /home/frank -g /etc/To specify usernames, categories, and yara files:	LEAF_main.py -u alice bob charlie -c applications executions users -y /home/alice/Desktop/yara1.yar /home/alice/Desktop/yara2.yarTo include custom input file(s) and categories:	LEAF_main.py -i /home/alice/Desktop/customfile1.txt /home/alice/Desktop/customfile2.t   xt -c apache xampp