capture from a live host
flesh out the tree