# sift-assistant — tools.env
# Single source of truth for forensic tool paths on the SANS SIFT workstation.
#
# Deployed by install.sh to ~/.claude/tools.env. Skills and the case-investigate
# pipeline load it with:   source ~/.claude/tools.env
#
# Convention: the variable name encodes the tool. Eric Zimmerman (EZ) tools
# carry an EZ prefix; everything else is named for its binary. This keeps the
# variable, the output-file tool token (ASSET-artifact-tool.ext), and the
# on-disk binary aligned. Override any line below to match a host that differs;
# run /tools-preflight to confirm every entry resolves before a case.
#
# Do not put case data here. Paths only.

# ── Memory ───────────────────────────────────────────────────────────────────
# Volatility 3 interpreter. v2.28.1
VOLATILITY3="python3 /opt/volatility3-2.28.1/vol.py"

# ── EZ Tools — Eric Zimmerman (.NET / dotnet) ────────────────────────────────
EZMFTECMD="dotnet /opt/zimmermantools/MFTECmd.dll"
EZEVTXECMD="dotnet /opt/zimmermantools/EvtxeCmd/EvtxECmd.dll"
EZEVTXECMD_MAPS="/opt/zimmermantools/EvtxeCmd/Maps/"
EVTXDUMP="/usr/local/bin/evtx_dump.py"   # INSTALLED — python-evtx fallback for EvtxECmd (dfir-evtx)
EZRECMD="dotnet /opt/zimmermantools/RECmd/RECmd.dll"
EZRECMD_BATCH="/opt/zimmermantools/RECmd/BatchExamples/Kroll_Batch.reb"
EZAMCACHEPARSER="dotnet /opt/zimmermantools/AmcacheParser.dll"
EZAMCACHE_WHITELIST="/opt/zimmermantools/AmcacheParser_whitelist.txt"   # MISSING on this host — optional whitelist (AmcacheParser itself is present)
EZAPPCOMPATCACHEPARSER="dotnet /opt/zimmermantools/AppCompatCacheParser.dll"
EZLECMD="dotnet /opt/zimmermantools/LECmd.dll"
EZJLECMD="dotnet /opt/zimmermantools/JLECmd.dll"
EZSBECMD="dotnet /opt/zimmermantools/SBECmd.dll"
EZSQLECMD="dotnet /opt/zimmermantools/SQLECmd/SQLECmd.dll"
EZSQLECMD_MAPS="/opt/zimmermantools/SQLECmd/Maps/"
EZWXTCMD="dotnet /opt/zimmermantools/WxTCmd.dll"
EZBSTRINGS="dotnet /opt/zimmermantools/bstrings.dll"
# RBCmd / RecentFileCacheParser ship on SIFT as /usr/local/bin wrappers (per SIFT_SERVER_DFIR_TOOLS.json);
# may alternately be "dotnet /opt/zimmermantools/RBCmd.dll" etc. — /tools-preflight confirms the real path.
EZRBCMD="/usr/local/bin/RBCmd"                            # Recycle Bin ($I/$R) — dfir-recyclebin
EZRECENTFILECACHE="/usr/local/bin/RecentFileCacheParser"  # RecentFileCache.bcf (Win7) — dfir-recentfilecache

# ── Python / Perl helpers and fallbacks (named for their tool) ───────────────
ANALYZEMFT="/opt/analyzemft/bin/analyzemft"            # fallback for EZMFTECMD (venv console script)
PREF="/usr/local/bin/pref.pl"                          # INSTALLED — primary prefetch parser on SIFT (Keydet pref.pl; text + CSV via -c); dfir-prefetch
PREFETCHPY="/usr/local/bin/prefetch.py"                # INSTALLED — fallback prefetch parser (windowsprefetch v4.0.3 in venv at /opt/windowsprefetch); dfir-prefetch; call directly as executable (shebang uses venv Python) — do NOT prefix with python3
ESEDBEXPORT="esedbexport"                              # libesedb ESE reader — SIFT-native SRUM/ESE parser (dfir-srum); SrumECmd+srum-dump MISSING. Verify with /tools-preflight.
HINDSIGHT="/opt/pyhindsight/bin/hindsight.py"           # INSTALLED — pyhindsight browser forensics; primary browser parser (dfir-browser)
REGRIPPER="rip.pl"                                     # fallback for several EZ hive parsers; call directly (shebang resolves perl) — do NOT prefix with perl
REGRIPPER_PLUGINS="/usr/share/regripper/plugins"

# ── Threat hunting / carving ─────────────────────────────────────────────────
YARA_PYTHON="python3"        # INSTALLED — interpreter with the python3-yara module (import yara); dfir-yara scans via python3
YARA_RULES="/opt/yara-rules"  # MISSING on this host — directory absent; supply a rules path per case

# ── PATH-resolved tools (no path needed; listed so /tools-preflight checks them) ─
# The Sleuth Kit, plaso, libewf and libvshadow binaries are expected on PATH:
#   ewfmount ewfverify ewfinfo
#   vshadowmount vshadowinfo
#   mmls mmstat fsstat fls icat istat ils ffind blkls tsk_recover mactime sigfind
#   log2timeline.py psort.py pinfo.py image_export.py
#   mount umount fusermount losetup findmnt file
# These are intentionally NOT variables — invoke them by name.
PREFLIGHT_PATH_TOOLS="ewfmount ewfverify ewfinfo vshadowmount vshadowinfo mmls fsstat fls icat istat ils ffind blkls tsk_recover mactime sigfind log2timeline.py psort.py image_export.py mount umount fusermount losetup findmnt file dotnet python3"