Sudo backups
System paths — /etc, /var/log, Longhorn replicas, container volumes — need root to read. --use-sudo re-execs fast-copy under sudo so you don't have to remember to elevate first, and it refuses to elevate at all if the script or its directory is group/world-writable (so a compromised working copy can't ride your privileges). Linux and macOS only.
Every privileged run is recorded: what was copied, when, by whom. The log is structured JSONL, owned by the invoking user, and made immutable with chattr +i after every write — a record can't be quietly edited or deleted afterwards, even by root, without leaving a visible trace of flipping the flag first.
--use-sudo re-execs the tool under sudo. The audit log is written to ~$SUDO_USER/.fast_copy_audit.jsonl with chattr +i after every write — even root can't quietly delete a record.Examples
Snapshot /etc, /var/log, and an operator home dir
fast-copy --use-sudo /etc /var/log /home/operator /mnt/incident_snapshot/Multi-source CLI (v3.1.0+) accepts any number of source paths followed by the destination; each source is copied as its own subtree under the destination, preserving its basename. For incident response and forensic captures, add -R/--keep-parents so the full origin path (dst/var/log/, not dst/log/) is preserved as provenance.
Self-update is refused while running under sudo, and elevation hardening details are covered in the options reference.