← Back
Home › Systems › Security and identity

digital-forensics

DFIR acquisition and analysis: disk/mobile imaging, file-system and artifact parsers, super-timelines, memory forensics, chain of custody

Magnet AXIOM, Cellebrite, Velociraptor, Volatility

SystemTechniques · 11Primitives · 51 digital-forensics Durable job queuedistributed · medium: Persisted tasks that workers lease for a visibility timeout, ack on success and retry with backoff; at-least-once execution that survives worker and queue crashes.›Image forensicsmachine-learning · medium: Detecting edited or synthetic images: error level analysis, noise residuals, learned manipulation detectorsOptical character recognition (text…machine-learning · medium: Find text lines in an image, read each crop with a CTC or attention model, then correct with a lexicon and score confidence for review routing.›Forensic disk imagingsecurity · medium: Bit-exact disk acquisition with write-blocking, hash verification and segmented evidence formatsProcess tree trackingsecurity · medium: Maintaining live process lineage (parent, command line, hashes) from OS events for detectionTamper-evident audit logsecurity · medium: An append-only log whose Merkle root, signed per batch, lets anyone verify an entry is present and history was never rewritten, with log-size proofs.›Yara rule matchingsecurity · medium: YARA-style rules: string patterns plus boolean conditions over files and memory, compiled to Aho-Corasick plus checksWrite-ahead logstorage · low: Append each change to a checksummed sequential log and fsync it before touching data pages; the basis of crash durability in nearly every database.›Digital signatures (Ed25519)security · low: Small, fast, deterministic public-key signatures that prove who produced a message; the default for tokens, releases and protocols.›Trusted timestampingsecurity · low: RFC 3161 time-stamp tokens: a TSA signs a hash with time, proving data existed thenAho-Corasick multi-pattern matchingsearch-sort · low: Find all occurrences of many fixed patterns in one pass over the text, in time independent of the pattern count, using a trie with failure links.›Executable formats elf pecompilers · low: ELF, PE and Mach-O: sections, segments, symbol tables, relocations, dynamic loadingSeekable compressed streamcompression · low: Independently compressed blocks plus an index for random access (BGZF, seekable zstd, eStargz)Virtual memory and the TLBhardware-os · low: How page tables and TLBs translate every address, what TLB reach means, and when 2 MiB or 1 GiB huge pages pay off on Linux.›Packet capture pcapnetworking · low: Lossless packet capture with hardware timestamps, pcap/pcapng format, replayTcp stream reassemblynetworking · low: Rebuild TCP byte streams from out-of-order, overlapping and retransmitted segments with a per-flow buffer and an overlap policyK way mergesearch-sort · low: Merge k sorted streams with a heap or loser tree (merging iterators)Perceptual hashingsearch-sort · low: Compact fingerprints (64 to 256 bits) of an image that stay close under resizing and recompression, compared by Hamming distance; pHash, dHash and Meta's PDQ.›Aes xts disk encryptionsecurity · low: AES-XTS tweakable sector encryption for block devices; why no integrity and how sector tweaks workCryptographic hashes (SHA-2, BLAKE3)security · low: Collision-resistant fingerprints of data; SHA-256 for interoperability, BLAKE3 for speed, HMAC/HKDF for keyed uses.›File carving signaturessecurity · low: Recover files from raw disk by header/footer signatures and structure validationB+ treestorage · low: Balanced high-fanout search tree with all values in linked leaves; the default on-disk index for point lookups and range scans.›Inode file layoutstorage · low: Inodes, directory entries and block/extent maps for a file namespace+ 4 more techniques+ 35 more primitives

Similar systems

Share the most building blocks with this one.

audit-log 16 %