ZeroTrace AirLeak
Persistence
What survives reboot, what doesn't, and where it lives
This page is a reference for what the AirLeak firmware keeps across reboots and where it lives.
At a glance
| What | Persists? | Where |
|---|---|---|
| Capture mode | yes | NVS |
| Config settings (device name, LED, threat-indicator tuning, emit thresholds, swarm) | yes | LittleFS /config.json |
| License | yes | flash |
| Diagnostic log (crash / heap / boot events) | yes | flash |
| Live device aggregator | no | RAM / PSRAM |
| Alert ring buffer | no | PSRAM |
Live state.read counters (uptime, ev/s, drop counts) | no | RAM |
AirLeak does not buffer or replay captured devices. There is no session recording on the device, the live device table exists only while the stream is flowing, and ages out as devices go quiet. Durable capture history (maps, drive logs) lives in the mobile app, not on the unit.
Configuration: LittleFS /config.json
User-tunable settings live in a JSON document on the unit's LittleFS filesystem, read and written over Bluetooth with config.get / config.set. See the Settings Reference for every key and default.
Writes are crash-safe: config.set writes to a sibling file and atomically renames it over the live file, so a power loss mid-write leaves the previous config intact. If the config file is ever found corrupt on boot, the firmware backs it up to /config.json.bak, recreates defaults, and continues.
Missing keys are healed on read, when the firmware loads the config it fills in any default key the document is missing, so a firmware update that adds a setting picks up its default without wiping your existing values.
Capture mode: NVS
The capture mode is persisted separately to NVS by mode.set and automatically restored on boot before the app connects. A unit last left in Monitor wakes up capturing.
License: flash
The HWID-bound license is stored on the unit. It survives reboots and is re-checked on boot; the firmware reports the licensed flag in identity.read. Capture stays held in setup until a valid key is stored.
Diagnostic log: flash
A small on-flash diagnostic log records crash, heap, and boot events with timestamps (diag.read / diag.clear). Because the capture stream itself is never buffered, this log is the persistent record used to investigate something that happened while you weren't watching, for example a heap-exhaustion event.
What doesn't persist
By design, these reset on every reboot:
- Live device aggregator, repopulates as new advertisements arrive.
- Alert ring buffer, the recent-alerts ring is operational state only.
state.readcounters, uptime, events-per-second, and the drop counters all reset at boot.
Firmware updates
Settings, mode, license, and the diagnostic log are not touched by a firmware update, they live in their own flash regions, separate from the application image.
There's no on-device factory-reset command. Settings are reset by rewriting /config.json to defaults through the app (each key via config.set); the capture mode is changed with mode.set; re-licensing uses the BLE license methods. See the RPC Reference.