Skip to main content

Command Line Parameters

Below are the command line parameters supported by Cado Host.

usage: cado-host.exe [-h] [--presigned_data PRESIGNED_DATA] [--presigned_url PRESIGNED_URL]
[--storage {aws,local,gcp,azure}] [--bucket BUCKET] [--access_key ACCESS_KEY]
[--secret_key SECRET_KEY] [--region REGION] [--sas SAS] [-l]
[--only_additional_files] [--single_file_unzipped SINGLE_FILE_UNZIPPED]
[--include_large_varc] [--skip_linux_memory] [--get_windows_memory] [-v]
[--verbose] [--verbose_network] [-dd DEFAULT_DRIVE] [-o OUTPUT_PATH]
[--no_cleanup] [--dev]

-h, --help show this help message and exit
--presigned_data PRESIGNED_DATA
Encoded upload credentials generated by Cado Response.
--presigned_url PRESIGNED_URL
Specify the presigned url you wish to upload files to.
--storage {aws,local,gcp,azure}
--bucket BUCKET Bucket to upload files to.
--access_key ACCESS_KEY
Access key of your AWS credentials.
--secret_key SECRET_KEY
Secret Key of your AWS credentials.
--region REGION AWS Region.
--sas SAS Shared Access Signature that can be used to upload triage/full disk to
an Azure container.
-l, --light_mode Enable light_mode where we only retrieve files 10 MB in size or less.
List multiple files/folders to collect with the space character between
Path to a local file containing a list of files/folders to collect. One
on each line.
Only collect files and folders specified in --additional-files.
--single_file_unzipped SINGLE_FILE_UNZIPPED
Directly upload a single file to storage and import. Useful as a
command line option for uploading files to Cado Response.
--include_large_varc Include open files and memory even if it exceeds 1MB in size (this can
be slow).
--skip_linux_memory Dont collect memory on Linux. Faster.
--get_windows_memory Acquire Process Memory on Windows systems. Unlike Linux, this is
disabled by default as its slower on Windows. Implicitly applies
-v, --version
-dd DEFAULT_DRIVE, --default_drive DEFAULT_DRIVE
Specify the default drive for your system.
-o OUTPUT_PATH, --output_path OUTPUT_PATH
Output path if running for local storage.
--no_cleanup Disable cleanup after triage.
--dev Runs cado host in development mode.

Example Command Line

cado-host.exe --additional_files "C:\tools\secretfile.txt" "C:\SuperSecretFolder"

Note that folders should NOT have trailing slashes. Files and folder paths should be delimted by a space and be enclosed in double quotes.