ato-source-smb

You can collect NIST 800-53 evidence from SMB shares by mounting or accessing them in read-only mode. The skill uses read-only mounting and depth-limited traversal to discover and copy artifacts without writing back to the source.

Yes, you can collect evidence from Windows file shares across macOS, Linux, and Windows. The skill uses mount_smbfs for macOS, mount.cifs or gvfs for Linux, and UNC paths for Windows to ensure cross-platform compatibility.

Read-only SMB mounting for forensic audits works by enforcing ambient credential usage and optionally applying preauth checks via auth-config. The skill detects the operating system, mounts the share safely, and performs a guarded unmount on exit to maintain auditable workflows.

Yes, SMB evidence collection supports depth-limited traversal for compliance checks. This scope-limited approach ensures controlled and repeatable runs, preventing unbounded searches across large file shares during security and regulatory audits.

The best way to perform cross-platform forensics on SMB shares is using a method that automatically detects your OS and applies the appropriate mounting tool, such as mount_smbfs or UNC paths, while enforcing read-only access and guarded unmounts on exit.

When using ambient credentials for SMB evidence collection, you are limited to the permissions of the current environment without explicit authentication overrides. The skill enforces this ambient usage and applies optional preauth checks via auth-config to manage access securely.