command pieces for forensics