Point it at disk + memory evidence; get a correlated, ATT&CK-mapped attack timeline. Rust DFIR orchestrator: one command ingests E01/EWF/VMDK/raw + memory dumps, parses NTFS/registry/EVTX/prefetch/LNK/SRUM/browser/Amcache + memory (processes, netstat, injection), correlates into a DuckDB super-timeline, scans threat-intel, and reports.
rust timeline incident-response forensics dfir ntfs digital-forensics sigma yara memory-forensics threat-intelligence mitre-attack evtx browser-forensics velociraptor duckdb windows-forensics disk-forensics linux-forensics attack-flow
-
Updated
Aug 17, 2026 - Rust