Arkime (formerly Moloch) is the tool that turns a 4-day forensic investigation into a 4-hour one — it stores every packet with searchable metadata so you can reconstruct exactly what happened during a security incident. This guide walks through choosing between full packet capture approaches, the tradeoffs involved, and a complete Arkime deployment on Linux with OpenSearch backend.