{
  "schema_version": "1.0",
  "description": "Machine-readable SIFT server DFIR tool router. Each entry maps a forensic artifact type to one installed command so an AI system can select appropriate tools for parsing, extraction, triage, or analysis.",
  "generated_from": {
    "source": "Generated from the teamdfir/sift-saltstack GitHub repository, using the SIFT server profile Salt states reachable from sift/server.sls through sift/include-server.sls.",
    "scope": "Command-line, analyst-facing DFIR tools installed by the SIFT server profile. GUI-only tools, libraries, runtimes, build dependencies, services, desktop helpers, and general support packages are intentionally excluded."
  },
  "entries": [
    {
      "artifact": "Windows Amcache Registry hive",
      "artifact_aliases": ["Amcache.hve", "Amcache"],
      "artifact_family": "windows_registry",
      "platforms": ["windows"],
      "tool": "AmcacheParser",
      "command": "/usr/local/bin/AmcacheParser",
      "package_context": "Zimmerman Tools",
      "analyst_use": "Parse Windows Amcache entries for program execution, file metadata, and inventory artifacts.",
      "input_examples": ["Amcache.hve", "C:\\Windows\\AppCompat\\Programs\\Amcache.hve"],
      "notes": "Lowercase wrapper `/usr/local/bin/amcacheparser` is also installed."
    },
    {
      "artifact": "Windows Amcache Registry hive",
      "artifact_aliases": ["Amcache.hve", "Amcache"],
      "artifact_family": "windows_registry",
      "platforms": ["windows"],
      "tool": "amcache.py",
      "command": "/usr/local/bin/amcache.py",
      "package_context": "amcache",
      "analyst_use": "Parse Amcache.hve with a Python Registry-based parser.",
      "input_examples": ["Amcache.hve"],
      "notes": ""
    },
    {
      "artifact": "Windows AppCompatCache ShimCache",
      "artifact_aliases": ["ShimCache", "AppCompatCache", "SYSTEM hive AppCompatCache"],
      "artifact_family": "windows_registry",
      "platforms": ["windows"],
      "tool": "AppCompatCacheParser",
      "command": "/usr/local/bin/AppCompatCacheParser",
      "package_context": "Zimmerman Tools",
      "analyst_use": "Parse ShimCache entries from Windows registry hives for evidence of executable presence and activity context.",
      "input_examples": ["SYSTEM", "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppCompatCache"],
      "notes": "Lowercase wrapper `/usr/local/bin/appcompatcacheparser` is also installed."
    },
    {
      "artifact": "Windows Event Log EVTX",
      "artifact_aliases": [".evtx", "EVTX", "Windows Event Log", "winevt"],
      "artifact_family": "windows_event_logs",
      "platforms": ["windows"],
      "tool": "EvtxECmd",
      "command": "/usr/local/bin/EvtxECmd",
      "package_context": "Zimmerman Tools",
      "analyst_use": "Parse EVTX files into structured records for timeline and event analysis.",
      "input_examples": ["*.evtx", "C:\\Windows\\System32\\winevt\\Logs\\Security.evtx"],
      "notes": "Lowercase wrapper `/usr/local/bin/evtxecmd` is also installed."
    },
    {
      "artifact": "Windows Event Log EVTX",
      "artifact_aliases": [".evtx", "EVTX", "Windows Event Log"],
      "artifact_family": "windows_event_logs",
      "platforms": ["windows"],
      "tool": "python-evtx dump",
      "command": "/usr/local/bin/evtx_dump.py",
      "package_context": "python-evtx",
      "analyst_use": "Dump EVTX records for direct inspection or lightweight conversion.",
      "input_examples": ["Security.evtx", "Microsoft-Windows-PowerShell%4Operational.evtx"],
      "notes": ""
    },
    {
      "artifact": "Windows Event Log EVTX",
      "artifact_aliases": [".evtx", "EVTX", "Windows Event Log"],
      "artifact_family": "windows_event_logs",
      "platforms": ["windows"],
      "tool": "python-evtx chunk slack dumper",
      "command": "/usr/local/bin/evtx_dump_chunk_slack.py",
      "package_context": "python-evtx",
      "analyst_use": "Recover and inspect EVTX chunk slack for residual event records.",
      "input_examples": ["Security.evtx"],
      "notes": ""
    },
    {
      "artifact": "Windows Event Log EVTX",
      "artifact_aliases": [".evtx", "EVTX", "Windows Event Log"],
      "artifact_family": "windows_event_logs",
      "platforms": ["windows"],
      "tool": "python-evtx JSON dumper",
      "command": "/usr/local/bin/evtx_dump_json.py",
      "package_context": "python-evtx",
      "analyst_use": "Convert EVTX records to JSON for scripted analysis and downstream processing.",
      "input_examples": ["*.evtx"],
      "notes": ""
    },
    {
      "artifact": "Windows Event Log EVTX",
      "artifact_aliases": [".evtx", "EVTX", "Windows Event Log"],
      "artifact_family": "windows_event_logs",
      "platforms": ["windows"],
      "tool": "python-evtx structure tools",
      "command": "/usr/local/bin/evtx_info.py",
      "package_context": "python-evtx",
      "analyst_use": "Inspect EVTX metadata and structure when validating damaged or unusual event logs.",
      "input_examples": ["*.evtx"],
      "notes": "Related commands include `evtx_record_structure.py`, `evtx_structure.py`, and `evtx_templates.py`."
    },
    {
      "artifact": "Windows Jump List",
      "artifact_aliases": ["JumpList", "AutomaticDestinations", "CustomDestinations", ".automaticDestinations-ms"],
      "artifact_family": "windows_user_activity",
      "platforms": ["windows"],
      "tool": "JLECmd",
      "command": "/usr/local/bin/JLECmd",
      "package_context": "Zimmerman Tools",
      "analyst_use": "Parse Windows Jump Lists for recently accessed files, applications, and user activity.",
      "input_examples": ["*.automaticDestinations-ms", "*.customDestinations-ms"],
      "notes": "Lowercase wrapper `/usr/local/bin/jlecmd` is also installed."
    },
    {
      "artifact": "Windows LNK shortcut",
      "artifact_aliases": [".lnk", "shortcut", "LNK"],
      "artifact_family": "windows_user_activity",
      "platforms": ["windows"],
      "tool": "LECmd",
      "command": "/usr/local/bin/LECmd",
      "package_context": "Zimmerman Tools",
      "analyst_use": "Parse Windows shortcut files for target paths, timestamps, volume metadata, and user activity.",
      "input_examples": ["*.lnk", "Recent\\*.lnk"],
      "notes": "Lowercase wrapper `/usr/local/bin/lecmd` is also installed."
    },
    {
      "artifact": "NTFS Master File Table",
      "artifact_aliases": ["$MFT", "MFT", "NTFS file records"],
      "artifact_family": "ntfs",
      "platforms": ["windows"],
      "tool": "MFTECmd",
      "command": "/usr/local/bin/MFTECmd",
      "package_context": "Zimmerman Tools",
      "analyst_use": "Parse NTFS MFT records into structured file metadata and timeline output.",
      "input_examples": ["$MFT"],
      "notes": "Lowercase wrapper `/usr/local/bin/mftecmd` is also installed."
    },
    {
      "artifact": "NTFS Master File Table",
      "artifact_aliases": ["$MFT", "MFT", "NTFS file records"],
      "artifact_family": "ntfs",
      "platforms": ["windows"],
      "tool": "analyzeMFT",
      "command": "/usr/local/bin/analyzemft",
      "package_context": "analyzeMFT",
      "analyst_use": "Parse NTFS Master File Table records for file metadata and timeline analysis.",
      "input_examples": ["$MFT"],
      "notes": ""
    },
    {
      "artifact": "NTFS MFT entry",
      "artifact_aliases": ["MFT record", "$MFT entry", "file record segment"],
      "artifact_family": "ntfs",
      "platforms": ["windows"],
      "tool": "dump-mft-entry",
      "command": "/usr/local/bin/dump-mft-entry.pl",
      "package_context": "dump-mft-entry",
      "analyst_use": "Decode an individual MFT entry for targeted NTFS filesystem analysis.",
      "input_examples": ["mft-entry.bin", "$MFT"],
      "notes": ""
    },
    {
      "artifact": "NTFS INDX directory index",
      "artifact_aliases": ["$I30", "INDX", "directory index", "NTFS index allocation"],
      "artifact_family": "ntfs",
      "platforms": ["windows"],
      "tool": "INDXParse",
      "command": "/usr/local/bin/INDXParse.py",
      "package_context": "indxparse",
      "analyst_use": "Parse NTFS directory index records to recover directory listing and file activity evidence.",
      "input_examples": ["$I30"],
      "notes": ""
    },
    {
      "artifact": "NTFS MFT and INDX correlation",
      "artifact_aliases": ["$MFT plus $I30", "MFT and INDX correlation", "NTFS directory index correlation"],
      "artifact_family": "ntfs",
      "platforms": ["windows"],
      "tool": "MFTINDX",
      "command": "/usr/local/bin/MFTINDX.py",
      "package_context": "indxparse",
      "analyst_use": "Correlate MFT and INDX artifacts for richer NTFS directory and file activity analysis.",
      "input_examples": ["$MFT", "$I30"],
      "notes": ""
    },
    {
      "artifact": "NTFS USN Journal",
      "artifact_aliases": ["$UsnJrnl", "$J", "USN", "change journal"],
      "artifact_family": "ntfs",
      "platforms": ["windows"],
      "tool": "USN Journal Parser",
      "command": "/usr/local/bin/usnparser",
      "package_context": "usnparser",
      "analyst_use": "Parse NTFS USN change journal records for filesystem activity timelines.",
      "input_examples": ["$UsnJrnl:$J", "$J"],
      "notes": ""
    },
    {
      "artifact": "Windows Recycle Bin",
      "artifact_aliases": ["$Recycle.Bin", "$I files", "$R files", "Recycle Bin"],
      "artifact_family": "windows_user_activity",
      "platforms": ["windows"],
      "tool": "RBCmd",
      "command": "/usr/local/bin/RBCmd",
      "package_context": "Zimmerman Tools",
      "analyst_use": "Parse Windows Recycle Bin metadata for deleted file names, paths, sizes, and deletion times.",
      "input_examples": ["$Recycle.Bin\\S-1-5-*\\$I*"],
      "notes": "Lowercase wrapper `/usr/local/bin/rbcmd` is also installed."
    },
    {
      "artifact": "Windows RecentFileCache",
      "artifact_aliases": ["RecentFileCache.bcf", "RecentFileCache"],
      "artifact_family": "windows_user_activity",
      "platforms": ["windows"],
      "tool": "RecentFileCacheParser",
      "command": "/usr/local/bin/RecentFileCacheParser",
      "package_context": "Zimmerman Tools",
      "analyst_use": "Parse RecentFileCache artifacts for evidence of program and file execution on older Windows systems.",
      "input_examples": ["RecentFileCache.bcf"],
      "notes": "Lowercase wrapper `/usr/local/bin/recentfilecacheparser` is also installed."
    },
    {
      "artifact": "Windows Registry hive",
      "artifact_aliases": ["Registry", "NTUSER.DAT", "USRCLASS.DAT", "SYSTEM", "SOFTWARE", "SAM", "SECURITY"],
      "artifact_family": "windows_registry",
      "platforms": ["windows"],
      "tool": "RECmd",
      "command": "/usr/local/bin/RECmd",
      "package_context": "Zimmerman Tools",
      "analyst_use": "Parse Windows Registry hives with batch files and plugins for user, system, and persistence artifacts.",
      "input_examples": ["NTUSER.DAT", "SYSTEM", "SOFTWARE"],
      "notes": "Lowercase wrapper `/usr/local/bin/recmd` is also installed."
    },
    {
      "artifact": "Windows Registry hive",
      "artifact_aliases": ["Registry", "NTUSER.DAT", "USRCLASS.DAT", "SYSTEM", "SOFTWARE", "SAM", "SECURITY"],
      "artifact_family": "windows_registry",
      "platforms": ["windows"],
      "tool": "RegRipper",
      "command": "/usr/local/bin/rip.pl",
      "package_context": "RegRipper",
      "analyst_use": "Run Registry plugins to extract user activity, persistence, USB history, shellbags, services, and system configuration.",
      "input_examples": ["NTUSER.DAT", "SYSTEM", "SOFTWARE", "SAM", "SECURITY"],
      "notes": "Plugins are installed under `/usr/share/regripper/plugins`."
    },
    {
      "artifact": "Windows Registry hive",
      "artifact_aliases": ["Registry", "REGF", "hive"],
      "artifact_family": "windows_registry",
      "platforms": ["windows"],
      "tool": "libregf tools",
      "command": "regfexport",
      "package_context": "libregf-tools",
      "analyst_use": "Export Registry hive contents for inspection or downstream processing.",
      "input_examples": ["NTUSER.DAT", "SYSTEM"],
      "notes": "Related commands include `regfinfo` and `regfmount`."
    },
    {
      "artifact": "Windows ShellBags",
      "artifact_aliases": ["ShellBags", "BagMRU", "USRCLASS.DAT shellbags"],
      "artifact_family": "windows_registry",
      "platforms": ["windows"],
      "tool": "SBECmd",
      "command": "/usr/local/bin/SBECmd",
      "package_context": "Zimmerman Tools",
      "analyst_use": "Parse ShellBag artifacts for folder access and user navigation evidence.",
      "input_examples": ["USRCLASS.DAT", "NTUSER.DAT"],
      "notes": "Lowercase wrapper `/usr/local/bin/sbecmd` is also installed."
    },
    {
      "artifact": "SQLite database",
      "artifact_aliases": [".sqlite", ".db", "SQLite", "browser database", "app database"],
      "artifact_family": "database",
      "platforms": ["windows", "macos", "linux", "android", "ios"],
      "tool": "SQLECmd",
      "command": "/usr/local/bin/SQLECmd",
      "package_context": "Zimmerman Tools",
      "analyst_use": "Parse SQLite databases and apply known artifact maps when available.",
      "input_examples": ["History", "places.sqlite", "sms.db", "*.sqlite"],
      "notes": "Lowercase wrapper `/usr/local/bin/sqlecmd` is also installed."
    },
    {
      "artifact": "SQLite deleted records",
      "artifact_aliases": ["deleted SQLite records", "SQLite carving", "freelist", "unallocated SQLite pages"],
      "artifact_family": "database",
      "platforms": ["windows", "macos", "linux", "android", "ios"],
      "tool": "sqlite-carver",
      "command": "/usr/local/bin/sqlite-carver",
      "package_context": "sqlite-carver",
      "analyst_use": "Recover deleted records from SQLite database files.",
      "input_examples": ["*.sqlite", "*.db"],
      "notes": ""
    },
    {
      "artifact": "Windows 10 Timeline",
      "artifact_aliases": ["ActivitiesCache.db", "Windows Timeline", "Connected Devices Platform"],
      "artifact_family": "windows_user_activity",
      "platforms": ["windows"],
      "tool": "WxTCmd",
      "command": "/usr/local/bin/WxTCmd",
      "package_context": "Zimmerman Tools",
      "analyst_use": "Parse Windows Timeline database artifacts for application and user activity.",
      "input_examples": ["ActivitiesCache.db"],
      "notes": "Lowercase wrapper `/usr/local/bin/wxtcmd` is also installed."
    },
    {
      "artifact": "Browser history",
      "artifact_aliases": ["Chrome history", "Chromium history", "Mozilla Firefox history", "browser artifacts", "History"],
      "artifact_family": "browser",
      "platforms": ["windows", "macos", "linux"],
      "tool": "Hindsight",
      "command": "/usr/local/bin/hindsight.py",
      "package_context": "Hindsight",
      "analyst_use": "Parse Chrome and Chromium browser history, downloads, extension data, and related browser artifacts.",
      "input_examples": ["Browser profile paths"],
      "notes": ""
    },
    {
      "artifact": "Java cache IDX",
      "artifact_aliases": ["Java IDX", "idx cache", "Java cache index"],
      "artifact_family": "application_artifacts",
      "platforms": ["windows", "macos", "linux"],
      "tool": "Java IDX Parser",
      "command": "/usr/local/bin/idx-parser",
      "package_context": "Java_IDX_Parser",
      "analyst_use": "Parse Java cache index files.",
      "input_examples": ["*.idx"],
      "notes": ""
    },
    {
      "artifact": "Windows Prefetch",
      "artifact_aliases": [".pf", "Prefetch", "Windows prefetch"],
      "artifact_family": "windows_execution",
      "platforms": ["windows"],
      "tool": "Keydet pref parser",
      "command": "/usr/local/bin/pref.pl",
      "package_context": "Keydet tools",
      "analyst_use": "Parse Prefetch artifacts for program execution context.",
      "input_examples": ["*.pf"],
      "notes": ""
    },
    {
      "artifact": "Windows LNK shortcut",
      "artifact_aliases": [".lnk", "shortcut"],
      "artifact_family": "windows_user_activity",
      "platforms": ["windows"],
      "tool": "Keydet LNK parser",
      "command": "/usr/local/bin/lnk.pl",
      "package_context": "Keydet tools",
      "analyst_use": "Parse Windows LNK files with a Perl artifact parser.",
      "input_examples": ["*.lnk"],
      "notes": ""
    },
    {
      "artifact": "Windows Jump List",
      "artifact_aliases": ["JumpList", "AutomaticDestinations", "CustomDestinations"],
      "artifact_family": "windows_user_activity",
      "platforms": ["windows"],
      "tool": "Keydet Jump List parser",
      "command": "/usr/local/bin/jl.pl",
      "package_context": "Keydet tools",
      "analyst_use": "Parse Jump List artifacts with a Perl artifact parser.",
      "input_examples": ["*.automaticDestinations-ms", "*.customDestinations-ms"],
      "notes": ""
    },
    {
      "artifact": "Windows Event Log EVT",
      "artifact_aliases": [".evt", "legacy event log"],
      "artifact_family": "windows_event_logs",
      "platforms": ["windows"],
      "tool": "Keydet EVT parser",
      "command": "/usr/local/bin/evtparse.pl",
      "package_context": "Keydet tools",
      "analyst_use": "Parse legacy Windows EVT event log files.",
      "input_examples": ["*.evt"],
      "notes": "Related command: `/usr/local/bin/evtrpt.pl`."
    },
    {
      "artifact": "Windows Event Log EVTX",
      "artifact_aliases": [".evtx", "EVTX"],
      "artifact_family": "windows_event_logs",
      "platforms": ["windows"],
      "tool": "Keydet EVTX parser",
      "command": "/usr/local/bin/evtxparse.pl",
      "package_context": "Keydet tools",
      "analyst_use": "Parse modern Windows EVTX event log files with a Perl parser.",
      "input_examples": ["*.evtx"],
      "notes": ""
    },
    {
      "artifact": "NTFS USN Journal",
      "artifact_aliases": ["$UsnJrnl", "$J", "USN"],
      "artifact_family": "ntfs",
      "platforms": ["windows"],
      "tool": "Keydet USN parser",
      "command": "/usr/local/bin/usnj.pl",
      "package_context": "Keydet tools",
      "analyst_use": "Parse NTFS USN Journal records with a Perl parser.",
      "input_examples": ["$UsnJrnl:$J"],
      "notes": ""
    },
    {
      "artifact": "macOS artifacts",
      "artifact_aliases": ["macOS image", "macOS full disk"],
      "artifact_family": "macos",
      "platforms": ["macos"],
      "tool": "mac_apt",
      "command": "/usr/local/bin/mac_apt.py",
      "package_context": "mac_apt",
      "analyst_use": "Parse a broad set of macOS artifacts from disk images or extracted filesystems.",
      "input_examples": ["mounted macOS volume", "macOS disk image"],
      "notes": ""
    },
    {
      "artifact": "macOS single artifact",
      "artifact_aliases": ["macOS single artifact", "single macOS artifact"],
      "artifact_family": "macos",
      "platforms": ["macos"],
      "tool": "mac_apt artifact-only parser",
      "command": "/usr/local/bin/mac_apt_artifact_only.py",
      "package_context": "mac_apt",
      "analyst_use": "Parse a selected macOS artifact without processing a full image.",
      "input_examples": ["com.apple.finder.plist", "History.db"],
      "notes": ""
    },
    {
      "artifact": "iOS artifacts",
      "artifact_aliases": ["iOS backup", "iOS filesystem extraction"],
      "artifact_family": "mobile",
      "platforms": ["ios"],
      "tool": "ios_apt",
      "command": "/usr/local/bin/ios_apt.py",
      "package_context": "mac_apt",
      "analyst_use": "Parse iOS artifacts from backups or extracted filesystems.",
      "input_examples": ["iOs image root path"],
      "notes": ""
    },
    {
      "artifact": "APFS filesystem",
      "artifact_aliases": ["APFS", "Apple File System", "apfs container"],
      "artifact_family": "filesystem",
      "platforms": ["macos", "ios"],
      "tool": "mac_apt APFS extractor",
      "command": "/usr/local/bin/extract_apfs_fs.py",
      "package_context": "mac_apt",
      "analyst_use": "Extract files from APFS images for later artifact parsing.",
      "input_examples": ["macOS APFS disc image", "APFS container", ".E01", ".dd", ".dmg"],
      "notes": ""
    },
    {
      "artifact": "APFS filesystem",
      "artifact_aliases": ["APFS", "Apple File System"],
      "artifact_family": "filesystem",
      "platforms": ["macos", "ios"],
      "tool": "libfsapfs tools",
      "command": "fsapfsinfo",
      "package_context": "libfsapfs-tools",
      "analyst_use": "Inspect APFS container and volume metadata.",
      "input_examples": ["macOS APFS disc image", "APFS container", ".E01", ".dd", ".dmg"],
      "notes": "Use `fsapfsmount` to mount supported APFS evidence."
    },
    {
      "artifact": "FileVault 2 encrypted volume",
      "artifact_aliases": ["FileVault", "FVDE", "encrypted macOS volume"],
      "artifact_family": "encrypted_volume",
      "platforms": ["macos"],
      "tool": "libfvde tools",
      "command": "fvdeinfo",
      "package_context": "libfvde-tools",
      "analyst_use": "Inspect FileVault 2 encrypted volume metadata and mount when credentials or keys are available.",
      "input_examples": ["encrypted macOS volume", ".dmg"],
      "notes": "Use `fvdemount` for mounting workflows."
    },
    {
      "artifact": "BitLocker encrypted volume",
      "artifact_aliases": ["BitLocker", "BDE", "FVE"],
      "artifact_family": "encrypted_volume",
      "platforms": ["windows"],
      "tool": "dislocker",
      "command": "dislocker",
      "package_context": "dislocker",
      "analyst_use": "Decrypt or mount BitLocker-protected volumes when recovery material is available.",
      "input_examples": ["BitLocker volume", "BEK file", "bitlocker-volume.dd", "RecoveryKey.bek"],
      "notes": "Related commands include `dislocker-bek`, `dislocker-file`, `dislocker-fuse`, and `dislocker-metadata`."
    },
    {
      "artifact": "BitLocker encrypted volume",
      "artifact_aliases": ["BitLocker", "BDE"],
      "artifact_family": "encrypted_volume",
      "platforms": ["windows"],
      "tool": "libbde tools",
      "command": "bdeinfo",
      "package_context": "libbde",
      "analyst_use": "Inspect BitLocker volume metadata and mount supported volumes.",
      "input_examples": ["BitLocker volume", "bitlocker-volume.dd"],
      "notes": "Use `bdemount` for mounting workflows."
    },
    {
      "artifact": "Memory image",
      "artifact_aliases": ["RAM dump", "memory dump", "memory capture"],
      "artifact_family": "memory",
      "platforms": ["windows", "macos", "linux"],
      "tool": "Volatility3",
      "command": "/usr/local/bin/vol",
      "package_context": "Volatility3",
      "analyst_use": "Analyze processes, DLLs, network connections, handles, registry hives, and malware indicators from memory captures.",
      "input_examples": ["mem.raw", "memory.dmp", "*.vmem"],
      "notes": "Interactive shell command: `/usr/local/bin/volshell`."
    },
    {
      "artifact": "AES keys in memory",
      "artifact_aliases": ["AES key", "memory key search", "crypto key recovery"],
      "artifact_family": "memory",
      "platforms": ["windows", "macos", "linux"],
      "tool": "AESKeyFinder",
      "command": "aeskeyfind",
      "package_context": "aeskeyfind",
      "analyst_use": "Search memory captures and raw binary data for AES key material.",
      "input_examples": ["mem.raw", "pagefile.sys"],
      "notes": ""
    },
    {
      "artifact": "RSA keys in memory",
      "artifact_aliases": ["RSA key", "memory key search", "private key recovery"],
      "artifact_family": "memory",
      "platforms": ["windows", "macos", "linux"],
      "tool": "RSAKeyFinder",
      "command": "rsakeyfind",
      "package_context": "rsakeyfind",
      "analyst_use": "Search memory captures and binary data for RSA key material.",
      "input_examples": ["mem.raw", "memory.dmp"],
      "notes": ""
    },
    {
      "artifact": "Windows pagefile",
      "artifact_aliases": ["pagefile.sys", "page file", "swap artifact"],
      "artifact_family": "memory",
      "platforms": ["windows"],
      "tool": "page-brute",
      "command": "/usr/local/bin/page-brute",
      "package_context": "page-brute",
      "analyst_use": "Search Windows pagefile data for useful strings, records, and memory remnants.",
      "input_examples": ["pagefile.sys"],
      "notes": ""
    },
    {
      "artifact": "PDF document",
      "artifact_aliases": [".pdf", "PDF", "suspicious PDF"],
      "artifact_family": "document",
      "platforms": ["windows", "macos", "linux"],
      "tool": "pdfid",
      "command": "/usr/local/bin/pdfid.py",
      "package_context": "pdf-tools",
      "analyst_use": "Triage PDF documents for JavaScript, embedded files, actions, and suspicious structural features.",
      "input_examples": ["*.pdf"],
      "notes": ""
    },
    {
      "artifact": "PDF document structure",
      "artifact_aliases": ["PDF objects", "PDF streams", "PDF structure"],
      "artifact_family": "document",
      "platforms": ["windows", "macos", "linux"],
      "tool": "pdf-parser",
      "command": "/usr/local/bin/pdf-parser.py",
      "package_context": "pdf-tools",
      "analyst_use": "Inspect PDF objects, streams, references, and embedded content.",
      "input_examples": ["*.pdf"],
      "notes": ""
    },
    {
      "artifact": "PDF embedded file",
      "artifact_aliases": ["PDF attachment", "embedded PDF file"],
      "artifact_family": "document",
      "platforms": ["windows", "macos", "linux"],
      "tool": "pdftool",
      "command": "/usr/local/bin/pdftool.py",
      "package_context": "pdf-tools",
      "analyst_use": "Manipulate or extract PDF elements during malicious document analysis.",
      "input_examples": ["*.pdf"],
      "notes": ""
    },
    {
      "artifact": "Windows PE executable",
      "artifact_aliases": [".exe", ".dll", "PE", "portable executable"],
      "artifact_family": "malware",
      "platforms": ["windows"],
      "tool": "pe-scanner",
      "command": "/usr/local/bin/pe-scanner",
      "package_context": "pe-scanner",
      "analyst_use": "Triage PE files for suspicious metadata, imports, sections, and indicators.",
      "input_examples": ["*.exe", "*.dll"],
      "notes": ""
    },
    {
      "artifact": "Windows PE executable in raw data",
      "artifact_aliases": ["PE carving", "MZ header", "carved executable"],
      "artifact_family": "malware",
      "platforms": ["windows"],
      "tool": "pe-carver",
      "command": "/usr/local/bin/pe-carver",
      "package_context": "pe-carver",
      "analyst_use": "Carve Windows PE files from binary data, memory dumps, or raw evidence.",
      "input_examples": ["mem.raw", "unallocated.bin"],
      "notes": ""
    },
    {
      "artifact": "Packed executable",
      "artifact_aliases": ["packed PE", "packer", "UPX-packed executable"],
      "artifact_family": "malware",
      "platforms": ["windows", "linux"],
      "tool": "packerid",
      "command": "/usr/local/bin/packerid.py",
      "package_context": "packerid",
      "analyst_use": "Identify packed executables during malware triage.",
      "input_examples": ["*.exe", "*.dll", "ELF samples"],
      "notes": ""
    },
    {
      "artifact": "Packed executable",
      "artifact_aliases": ["UPX", "packed binary", "UPX-packed executable"],
      "artifact_family": "malware",
      "platforms": ["windows", "linux"],
      "tool": "UPX",
      "command": "upx",
      "package_context": "upx-ucl",
      "analyst_use": "Inspect or unpack UPX-packed binaries during malware triage.",
      "input_examples": ["packed.exe", "packed ELF"],
      "notes": ""
    },
    {
      "artifact": "Binary entropy",
      "artifact_aliases": ["entropy", "encrypted blob", "packed blob", "high entropy"],
      "artifact_family": "malware",
      "platforms": ["windows", "macos", "linux"],
      "tool": "densityscout",
      "command": "/usr/local/bin/densityscout",
      "package_context": "densityscout",
      "analyst_use": "Identify high-entropy regions and packed or encrypted content.",
      "input_examples": ["sample.bin", "firmware.bin"],
      "notes": ""
    },
    {
      "artifact": "Disk image filesystem",
      "artifact_aliases": ["raw disk image", "filesystem", "partition image", "dd image"],
      "artifact_family": "filesystem",
      "platforms": ["windows", "macos", "linux"],
      "tool": "Sleuth Kit fls",
      "command": "fls",
      "package_context": "sleuthkit",
      "analyst_use": "List files and directories from filesystems inside disk images.",
      "input_examples": ["disk.dd", "image.raw"],
      "notes": "Related commands include `icat`, `istat`, `mmls`, `fsstat`, and `tsk_recover`."
    },
    {
      "artifact": "Disk image partition table",
      "artifact_aliases": ["partition table", "MBR", "GPT", "volume layout"],
      "artifact_family": "filesystem",
      "platforms": ["windows", "macos", "linux"],
      "tool": "Sleuth Kit mmls",
      "command": "mmls",
      "package_context": "sleuthkit",
      "analyst_use": "Enumerate partition layouts and offsets in disk images.",
      "input_examples": ["disk.dd", "image.raw", "image.E01"],
      "notes": ""
    },
    {
      "artifact": "Disk image file recovery",
      "artifact_aliases": ["deleted files", "file recovery"],
      "artifact_family": "filesystem",
      "platforms": ["windows", "macos", "linux"],
      "tool": "Sleuth Kit tsk_recover",
      "command": "tsk_recover",
      "package_context": "sleuthkit",
      "analyst_use": "Recover allocated and deleted files from supported filesystems.",
      "input_examples": ["disk.dd", "image.raw"],
      "notes": ""
    },
    {
      "artifact": "EWF forensic image",
      "artifact_aliases": [".E01", "E01", "Expert Witness Format", "EWF"],
      "artifact_family": "disk_image",
      "platforms": ["windows", "macos", "linux"],
      "tool": "ewf-tools",
      "command": "ewfmount",
      "package_context": "libewf-tools",
      "analyst_use": "Mount EWF images for downstream filesystem and artifact analysis.",
      "input_examples": ["image.E01", "evidence.Ex01"],
      "notes": "Use `ewfinfo` for metadata and `ewfverify` for verification."
    },
    {
      "artifact": "AFF forensic image",
      "artifact_aliases": [".aff", "AFF", "Advanced Forensic Format"],
      "artifact_family": "disk_image",
      "platforms": ["windows", "macos", "linux"],
      "tool": "afflib-tools",
      "command": "affinfo",
      "package_context": "afflib-tools",
      "analyst_use": "Inspect AFF image metadata and handle AFF forensic image workflows.",
      "input_examples": ["image.aff"],
      "notes": "Package-managed AFF commands are installed."
    },
    {
      "artifact": "Virtual disk image",
      "artifact_aliases": ["VMDK", "VHD", "QCOW", "RAW", "virtual disk"],
      "artifact_family": "disk_image",
      "platforms": ["windows", "macos", "linux"],
      "tool": "qemu-img",
      "command": "qemu-img",
      "package_context": "qemu-utils",
      "analyst_use": "Inspect and convert virtual disk image formats for analysis.",
      "input_examples": ["disk.vmdk", "disk.vhd", "disk.qcow2"],
      "notes": "Use `qemu-nbd` to expose virtual disks as block devices."
    },
    {
      "artifact": "VMware VMDK image",
      "artifact_aliases": [".vmdk", "VMDK", "VMware disk"],
      "artifact_family": "disk_image",
      "platforms": ["windows", "macos", "linux"],
      "tool": "libvmdk tools",
      "command": "vmdkinfo",
      "package_context": "libvmdk",
      "analyst_use": "Inspect and mount VMware VMDK disk images.",
      "input_examples": ["disk.vmdk"],
      "notes": "Use `vmdkmount` for mounting workflows."
    },
    {
      "artifact": "Forensic image format conversion",
      "artifact_aliases": ["image conversion", "forensic image conversion", "virtual disk representation"],
      "artifact_family": "disk_image",
      "platforms": ["windows", "macos", "linux"],
      "tool": "xmount",
      "command": "xmount",
      "package_context": "xmount",
      "analyst_use": "Convert and expose forensic images as virtual disk formats for analysis.",
      "input_examples": ["image.E01", "image.aff", "image.dd"],
      "notes": ""
    },
    {
      "artifact": "Damaged disk or block device",
      "artifact_aliases": ["failing disk", "bad sectors", "damaged media"],
      "artifact_family": "acquisition",
      "platforms": ["windows", "macos", "linux"],
      "tool": "GNU ddrescue",
      "command": "ddrescue",
      "package_context": "gddrescue",
      "analyst_use": "Recover readable data from damaged media while tracking bad sectors.",
      "input_examples": ["/dev/sdX", "rescue.img", "rescue.log"],
      "notes": ""
    },
    {
      "artifact": "Block device acquisition",
      "artifact_aliases": ["disk acquisition", "forensic image", "dd image"],
      "artifact_family": "acquisition",
      "platforms": ["windows", "macos", "linux"],
      "tool": "dc3dd",
      "command": "dc3dd",
      "package_context": "dc3dd",
      "analyst_use": "Create forensic images with hashing and acquisition logging features.",
      "input_examples": ["/dev/sdX", "image.dd"],
      "notes": ""
    },
    {
      "artifact": "Block device acquisition",
      "artifact_aliases": ["disk acquisition", "forensic image", "dd image"],
      "artifact_family": "acquisition",
      "platforms": ["windows", "macos", "linux"],
      "tool": "dcfldd",
      "command": "dcfldd",
      "package_context": "dcfldd",
      "analyst_use": "Create forensic images with hashing, splitting, and progress features.",
      "input_examples": ["/dev/sdX", "image.dd"],
      "notes": ""
    },
    {
      "artifact": "Packet capture",
      "artifact_aliases": [".pcap", ".pcapng", "network capture", "packet capture"],
      "artifact_family": "network",
      "platforms": ["windows", "macos", "linux"],
      "tool": "tshark",
      "command": "tshark",
      "package_context": "Wireshark CLI tools",
      "analyst_use": "Inspect, filter, and extract fields from packet captures.",
      "input_examples": ["capture.pcap", "capture.pcapng"],
      "notes": "Related commands include `capinfos`, `editcap`, and `mergecap`."
    },
    {
      "artifact": "Packet capture TCP streams",
      "artifact_aliases": ["TCP flow", "pcap TCP stream", "network session"],
      "artifact_family": "network",
      "platforms": ["windows", "macos", "linux"],
      "tool": "tcpflow",
      "command": "tcpflow",
      "package_context": "tcpflow",
      "analyst_use": "Reassemble and extract TCP flows from packet captures.",
      "input_examples": ["capture.pcap"],
      "notes": ""
    },
    {
      "artifact": "Packet capture files",
      "artifact_aliases": ["file carving from pcap", "network carved files", "packet capture file carving"],
      "artifact_family": "network",
      "platforms": ["windows", "macos", "linux"],
      "tool": "tcpxtract",
      "command": "tcpxtract",
      "package_context": "tcpxtract",
      "analyst_use": "Carve files from packet captures.",
      "input_examples": ["capture.pcap"],
      "notes": ""
    },
    {
      "artifact": "NetFlow records",
      "artifact_aliases": ["NetFlow", "network flow records"],
      "artifact_family": "network",
      "platforms": ["windows", "macos", "linux"],
      "tool": "nfdump",
      "command": "nfdump",
      "package_context": "nfdump",
      "analyst_use": "Process and query NetFlow records for network activity analysis.",
      "input_examples": ["nfcapd.*"],
      "notes": ""
    },
    {
      "artifact": "PST or OST mail store",
      "artifact_aliases": [".pst", ".ost", "Outlook mail", "PFF"],
      "artifact_family": "email",
      "platforms": ["windows"],
      "tool": "pff-tools",
      "command": "pffexport",
      "package_context": "pff-tools",
      "analyst_use": "Export messages and folders from Outlook PST or OST evidence.",
      "input_examples": ["mailbox.pst", "archive.ost"],
      "notes": "Use `pffinfo` for metadata."
    },
    {
      "artifact": "PST mail store",
      "artifact_aliases": [".pst", "Outlook PST", "email archive"],
      "artifact_family": "email",
      "platforms": ["windows"],
      "tool": "readpst",
      "command": "readpst",
      "package_context": "pst-utils",
      "analyst_use": "Convert and extract messages from Outlook PST files.",
      "input_examples": ["mailbox.pst"],
      "notes": ""
    },
    {
      "artifact": "Mobile device backup or filesystem",
      "artifact_aliases": ["Android backup", "iOS backup", "mobile artifacts"],
      "artifact_family": "mobile",
      "platforms": ["android", "ios"],
      "tool": "MVT",
      "command": "/usr/local/bin/mvt-ios",
      "package_context": "mvt",
      "analyst_use": "Analyze Android and iOS backups, filesystem extractions, and related mobile artifacts for compromise indicators.",
      "input_examples": ["Android backup", "Android filesystem dump", "iTunes backup", "iOS filesystem dump"],
      "notes": "Use `/usr/local/bin/mvt-android` for Android evidence."
    },
    {
      "artifact": "Android device",
      "artifact_aliases": ["Android filesystem", "Android device collection"],
      "artifact_family": "mobile",
      "platforms": ["android"],
      "tool": "Android platform tools",
      "command": "adb",
      "package_context": "android-sdk-platform-tools",
      "analyst_use": "Acquire and inspect Android device data when USB debugging or authorized access is available.",
      "input_examples": ["connected Android device"],
      "notes": "Related command: `fastboot`."
    },
    {
      "artifact": "Apple mobile device",
      "artifact_aliases": ["iPhone", "iPad", "Apple mobile extraction"],
      "artifact_family": "mobile",
      "platforms": ["ios"],
      "tool": "UFADE",
      "command": "/usr/local/bin/ufade",
      "package_context": "UFADE",
      "analyst_use": "Extract data from supported Apple mobile devices.",
      "input_examples": ["connected iOS device"],
      "notes": ""
    },
    {
      "artifact": "Windows USB device history",
      "artifact_aliases": ["USBSTOR", "USB history", "Windows USB artifacts"],
      "artifact_family": "windows_registry",
      "platforms": ["windows"],
      "tool": "usbdeviceforensics",
      "command": "/usr/local/bin/usbdeviceforensics",
      "package_context": "usbdeviceforensics",
      "analyst_use": "Parse Windows USB device artifacts for connection history.",
      "input_examples": ["SYSTEM hive"],
      "notes": ""
    },
    {
      "artifact": "Timeline from mixed forensic artifacts",
      "artifact_aliases": ["super timeline", "forensic timeline", "timeline from forensic artifacts"],
      "artifact_family": "timeline",
      "platforms": ["windows", "macos", "linux"],
      "tool": "Plaso log2timeline",
      "command": "log2timeline.py",
      "package_context": "plaso-tools",
      "analyst_use": "Build a forensic timeline from filesystems, logs, browser artifacts, and OS artifacts.",
      "input_examples": ["disk.dd", "image.E01", "/mnt/evidence"],
      "notes": "Use `psort.py` to process Plaso storage files and `psteal.py` for combined collection and output workflows."
    },
    {
      "artifact": "File hash set",
      "artifact_aliases": ["hashes", "known-good hash set", "known-bad hash set"],
      "artifact_family": "triage",
      "platforms": ["windows", "macos", "linux"],
      "tool": "hashdeep",
      "command": "hashdeep",
      "package_context": "hashdeep",
      "analyst_use": "Compute, audit, and match cryptographic hashes for file triage and integrity verification.",
      "input_examples": ["/mnt/evidence", "file"],
      "notes": "Related command: `md5deep`."
    },
    {
      "artifact": "Fuzzy file hash",
      "artifact_aliases": ["ssdeep", "fuzzy hash", "similarity hash"],
      "artifact_family": "triage",
      "platforms": ["windows", "macos", "linux"],
      "tool": "ssdeep",
      "command": "ssdeep",
      "package_context": "ssdeep",
      "analyst_use": "Compute and compare fuzzy hashes for file similarity analysis.",
      "input_examples": ["sample.exe", "samples/"],
      "notes": ""
    },
    {
      "artifact": "Metadata in files",
      "artifact_aliases": ["file metadata", "image metadata", "document metadata", "media metadata"],
      "artifact_family": "metadata",
      "platforms": ["windows", "macos", "linux"],
      "tool": "exiftool",
      "command": "exiftool",
      "package_context": "exiftool",
      "analyst_use": "Read and extract metadata from images, documents, and media files.",
      "input_examples": ["*.jpg", "*.pdf", "*.docx", "*.mp4"],
      "notes": ""
    },
    {
      "artifact": "Image EXIF metadata",
      "artifact_aliases": ["EXIF", "JPEG metadata", "photo metadata"],
      "artifact_family": "metadata",
      "platforms": ["windows", "macos", "linux"],
      "tool": "exif",
      "command": "exif",
      "package_context": "exif",
      "analyst_use": "Extract EXIF metadata from image files.",
      "input_examples": ["*.jpg", "*.jpeg"],
      "notes": ""
    },
    {
      "artifact": "Archive file",
      "artifact_aliases": ["zip", "7z", "rar", "tar", "compressed archive"],
      "artifact_family": "archive",
      "platforms": ["windows", "macos", "linux"],
      "tool": "7-Zip",
      "command": "7z",
      "package_context": "p7zip-full",
      "analyst_use": "Extract and inspect archive formats commonly found in evidence and malware packages.",
      "input_examples": ["*.zip", "*.7z", "*.tar", "*.gz"],
      "notes": "Related command: `7za`."
    },
    {
      "artifact": "RAR archive",
      "artifact_aliases": [".rar", "RAR"],
      "artifact_family": "archive",
      "platforms": ["windows", "macos", "linux"],
      "tool": "unrar",
      "command": "unrar",
      "package_context": "unrar",
      "analyst_use": "Extract RAR archives encountered in evidence sets.",
      "input_examples": ["*.rar"],
      "notes": ""
    },
    {
      "artifact": "Microsoft CAB archive",
      "artifact_aliases": [".cab", "cabinet file", "Windows cabinet"],
      "artifact_family": "archive",
      "platforms": ["windows"],
      "tool": "cabextract",
      "command": "cabextract",
      "package_context": "cabextract",
      "analyst_use": "Extract files from Windows cabinet archives found in installers, updates, or malware packages.",
      "input_examples": ["*.cab"],
      "notes": ""
    },
    {
      "artifact": "Deleted files in raw data",
      "artifact_aliases": ["unallocated space", "carved files", "deleted file fragments"],
      "artifact_family": "recovery",
      "platforms": ["windows", "macos", "linux"],
      "tool": "foremost",
      "command": "foremost",
      "package_context": "foremost",
      "analyst_use": "Recover files by header and footer carving from raw data.",
      "input_examples": ["disk.dd", "unallocated.bin"],
      "notes": ""
    },
    {
      "artifact": "Deleted files in raw data",
      "artifact_aliases": ["unallocated space", "carved files", "deleted file fragments"],
      "artifact_family": "recovery",
      "platforms": ["windows", "macos", "linux"],
      "tool": "scalpel",
      "command": "scalpel",
      "package_context": "scalpel",
      "analyst_use": "Carve files from disk images and raw binary evidence using configurable signatures.",
      "input_examples": ["disk.dd", "unallocated.bin"],
      "notes": ""
    },
    {
      "artifact": "Lost partition or deleted media files",
      "artifact_aliases": ["lost partition", "deleted media files", "partition table"],
      "artifact_family": "recovery",
      "platforms": ["windows", "macos", "linux"],
      "tool": "testdisk",
      "command": "testdisk",
      "package_context": "testdisk",
      "analyst_use": "Recover lost partitions and deleted media files from disks, disk images, and removable media when appropriate.",
      "input_examples": ["disk.dd", "image.raw", "/dev/sdX"],
      "notes": "Use `photorec` for file carving and media file recovery."
    },
    {
      "artifact": "ext3 or ext4 deleted files",
      "artifact_aliases": ["ext3", "ext4", "deleted Linux files"],
      "artifact_family": "filesystem",
      "platforms": ["linux"],
      "tool": "extundelete",
      "command": "extundelete",
      "package_context": "extundelete",
      "analyst_use": "Recover deleted files from ext3/ext4 filesystems where journal data permits.",
      "input_examples": ["partition.dd", "image.raw"],
      "notes": ""
    },
    {
      "artifact": "STIX threat intelligence document",
      "artifact_aliases": ["STIX", "STIX document", "STIX threat intelligence"],
      "artifact_family": "threat_intelligence",
      "platforms": ["windows", "macos", "linux"],
      "tool": "stix-validator",
      "command": "/usr/local/bin/stix-validator",
      "package_context": "stix-validator",
      "analyst_use": "Validate STIX-formatted threat intelligence before sharing or ingestion.",
      "input_examples": ["*.xml", "*.json"],
      "notes": ""
    },
    {
      "artifact": "OpenIOC document",
      "artifact_aliases": ["OpenIOC", "OpenIOC document", "indicator document"],
      "artifact_family": "threat_intelligence",
      "platforms": ["windows", "macos", "linux"],
      "tool": "ioc_writer",
      "command": "/usr/local/bin/iocdump",
      "package_context": "ioc_writer",
      "analyst_use": "Create and write OpenIOC indicator documents for threat intelligence sharing or downstream ingestion.",
      "input_examples": ["*.ioc"],
      "notes": "Related commands include `openioc_10_to_11` and `openioc_11_to_10`."
    },
    {
      "artifact": "Indicator enrichment target",
      "artifact_aliases": ["domain", "IP address", "URL", "hash"],
      "artifact_family": "threat_intelligence",
      "platforms": ["windows", "macos", "linux"],
      "tool": "machinae",
      "command": "/usr/local/bin/machinae",
      "package_context": "machinae",
      "analyst_use": "Enrich indicators through configured OSINT and threat-intelligence services.",
      "input_examples": ["example.com", "1.2.3.4", "SHA256 hash"],
      "notes": "Configuration path: `/etc/machinae.yml`."
    },
    {
      "artifact": "Encoded string or data blob",
      "artifact_aliases": ["base64", "URL encoding", "hex string", "encoded data"],
      "artifact_family": "triage",
      "platforms": ["windows", "macos", "linux"],
      "tool": "CyberChef",
      "command": "/var/www/html/cyberchef/index.html",
      "package_context": "CyberChef",
      "analyst_use": "Decode, transform, and triage strings or data extracted from evidence through a local web interface.",
      "input_examples": ["encoded string", "hex blob"],
      "notes": "This is a local web application rather than a CLI executable."
    },
    {
      "artifact": "Binary executable or firmware",
      "artifact_aliases": ["binary executable", "firmware", "malware sample"],
      "artifact_family": "malware",
      "platforms": ["windows", "macos", "linux"],
      "tool": "radare2",
      "command": "r2",
      "package_context": "radare2",
      "analyst_use": "Reverse engineer and inspect binaries, firmware, and malware samples.",
      "input_examples": ["sample.exe", "firmware.bin", "ELF binary"],
      "notes": ""
    },
    {
      "artifact": "Binary file comparison",
      "artifact_aliases": ["binary diff", "hex comparison", "byte comparison"],
      "artifact_family": "triage",
      "platforms": ["windows", "macos", "linux"],
      "tool": "vbindiff",
      "command": "vbindiff",
      "package_context": "vbindiff",
      "analyst_use": "Compare binary files and inspect byte-level differences.",
      "input_examples": ["file1.bin", "file2.bin"],
      "notes": ""
    }
  ]
}