COLDCASE is a local defensive triage tool.

It may:

• scan folders,
• calculate hashes,
• estimate entropy,
• collect system command output,
• store local case data,
• generate local reports.

It must not:

• delete user files,
• quarantine files automatically,
• disable services,
• kill processes,
• upload evidence,
• exploit systems,
• add persistence,
• hide activity.

Reports are review material, not automatic judgment.