Credential verification and query scope derivation, shared by the control plane's forensics authorization funnel and the standalone Query plane, with no…
Fast streaming ASCII/UTF-16LE string extractor for raw binaries, firmware and memory dumps, with entropy, magic-bytes and noise filtering. Never loads the…
Fast streaming ASCII/UTF-16LE string extractor for raw memory dump (.dmp) files, with simple noise filtering for byte-fill/heap-fill patterns. Never loads the…
macOS Unified Logs (tracev3, timesync, uuidtext and shared cache strings) for forensics: every log entry with its time, process, subsystem, format string and…
Windows image caches for forensics: Explorer's thumbcache and iconcache databases (every thumbnail with its cache id, checksums and image bytes) and the RDP…
Windows text logs for forensics: Program Compatibility Assistant (execution, Windows 11), IIS and Windows Firewall (W3C), PowerShell transcripts, TeamViewer…
Windows BITS job queues for forensics: qmgr.db (Windows 10 and later) and qmgr0.dat/qmgr1.dat (XP to 8.1), each job's owner, files and the command it runs when…
A forensic triage collector for Windows: reads NTFS raw (locked files, $MFT, $UsnJrnl, hives with their logs) and streams what a signed job names into one zip…
Cloud sync clients' records for forensics: Dropbox's sync history, Google Drive's snapshot of cloud and local files with their paths, and its sync log.
Messaging apps' databases for forensics: Skype's main.db, with its accounts, contacts, chats and messages, calls and their members, SMS and file transfers.
NTFS directory indexes ($I30 INDX records) for forensics: every entry with its $FILE_NAME times and sizes, and the deleted and renamed entries left in index…
Office document metadata for forensics: authors, last saved by, created, saved and printed times, edit time, counts, company and template, from 97-2003…
macOS Spotlight store databases (store.db, .store.db) for forensics: every file Spotlight indexed, with its name, kind, content type and times (added, used,…
Application text logs for forensics: vsftpd, PostgreSQL, Debian popularity-contest, Snort and Suricata fast alerts, Google logging (glog), Santa, macOS…