dellrall/booto

How dellrall/booto works

Booto is an offline, read-only Linux forensic framework. Its primary workflow is CLI or TUI launch, target discovery and read-only mounting, a coordinated scan of boot and system artifacts, then a verdict and case report. The TUI also exposes device-firmware checks, findings, and evidence; the README documents additional scanner capabilities whose call sites were not sampled. Dashed links mark those unverified orchestration details rather than asserting specific calls.

Main entry points: forensic_scan.c Scan orchestrator · tui_app.c Interactive TUI · main.c CLI dispatcher · disk_mount.c Device discovery

Components 21

Entry and interface

CLI dispatcher src/main.c
Interactive TUI src/tui/tui_app.c
Terminal input src/tui/terminal.c
Pane handlers src/tui/pane.c
BSP window manager src/tui/wm.c

Target and scan

Device discovery src/disk_mount.c
Read-only mounter src/disk_mount.c
Scan orchestrator src/forensic_scan.c

Detection engines

MBR and VBR audit src/mbr_auditor.c
UEFI and ESP audit src/uefi_analyzer.c
Kernel and LKM audit src/kernel_inspector.c
Initramfs audit src/initramfs_auditor.c
Preload scan src/preload_scanner.c
Package integrity src/pkg_integrity.c
Windows boot audit src/windows_boot.c
Host firmware audit src/firmware_auditor.c
Signed rules src/rules_loader.c

Evidence and reporting

Case reports src/case_reporter.c
Report persistence src/persistence_mgr.c
Forensic logs src/logger.c

Other components

Operator

Connections 24

Operator → CLI dispatcher: starts
CLI dispatcher → Interactive TUI: launches src/main.c
CLI dispatcher → Scan orchestrator: dispatches src/main.c
CLI dispatcher → Device discovery: configures
Interactive TUI → Terminal input: uses src/tui/tui_app.c
Interactive TUI → BSP window manager: uses src/tui/tui_app.c
Interactive TUI → Pane handlers: renders src/tui/tui_app.c
Interactive TUI → Scan orchestrator: runs
Interactive TUI → Case reports: exports
Device discovery → Read-only mounter: selects devices src/disk_mount.c
Scan orchestrator → Read-only mounter: mounts target
Scan orchestrator → MBR and VBR audit: audits sectors
Scan orchestrator → UEFI and ESP audit: audits ESP
Scan orchestrator → Kernel and LKM audit: audits kernel
Scan orchestrator → Initramfs audit: audits initramfs
Scan orchestrator → Preload scan: scans preload
Scan orchestrator → Package integrity: checks packages
Scan orchestrator → Windows boot audit: checks Windows
Scan orchestrator → Host firmware audit: audits host
MBR and VBR audit → Signed rules: loads signatures src/mbr_auditor.c
Host firmware audit → Signed rules: loads rules src/firmware_auditor.c
Scan orchestrator → Case reports: records results
Interactive TUI → Report persistence: manages storage
Scan orchestrator → Forensic logs: logs activity src/forensic_scan.c

Drawn by GitDiagram on November 11, 2026 from the repository's file tree, README and source files. Read as Markdown ·