VMware ESXi for forensics: the host configuration (esx.conf), the VM inventory (vmInventory.xml), VM settings (.vmx) and snapshots (.vmsd): what ran on the…
Walkthroughs over a caretline host's screen: steps of layers, narration and the host's own scene, a pure reducer, predicates the host answers, and protocol ops
Windows 10/11 notifications (wpndatabase.db) for forensics: toasts, tiles and badges apps raised, with their app, times and visible text, and the apps…
Windows Portable Executable (PE) metadata for forensics: compile time, type, sections, imports, exports, import hash, version information, PDB path, resource…
SecantusDB's fork of pgwire 0.40.7 (the PostgreSQL wire protocol as a library), carrying the changes the secantus-pg server needs. Internal; depend on upstream…
Windows Volume Shadow Copies (VSS) in an NTFS volume: every snapshot with its times, GUIDs and machine names, and each snapshot's view of the volume as a Read…
Cloud sync clients' records for forensics: Dropbox's sync history, Google Drive's snapshot of cloud and local files with their paths, and its sync log.
Messaging apps' databases for forensics: Skype's main.db, with its accounts, contacts, chats and messages, calls and their members, SMS and file transfers.
Comment-preserving JSONC parse, immutable edit, and canonical emit for Rust: every object key and value keeps one queryable attached comment, numbers compare…
Bounded autonomy for self-acting systems: an autonomy ladder (off/suggest/safe-apply/full), protected surfaces that never auto-apply, blast-radius caps, rate…
