vulkro-sf org forensic-snapshot
Saves the live org's identity and sharing state to one JSON file you can analyse offline during an incident.
vulkro-sf org forensic-snapshot --target-org <alias> --output snapshot.json --incident-ref INC-4821
What the file holds
Users, permission sets and their assignments, organization-wide defaults, sharing rules and recent login history. Each file also records a schema_version, the capture time, the org alias, the tool version and the optional incident reference.
Flags
| Flag | Meaning |
|---|---|
--target-org, -o <alias> | Org alias or username from sf org login. Required. |
--output, -O <path> | Where to write the JSON file. Required. Note the capital -O. |
--incident-ref <ref> | Ticket or incident ID stored in the file, for chain of custody. |
This command collects data only: it reports no findings. The file contains user and login data and is neither encrypted nor signed, so store it like any other incident evidence.
Exit codes: 0 snapshot written, 2 error (the org could not be read or the file could not be written). It never exits 1.
See also: org audit-trail, logs.