The record is free software. The practice around it is the product.

The method that is true whatever the evidence came from: read the container and find the volume, prove the evidence is unchanged, read the catalog before spending a token, extract and carve, tell an encrypted volume from an unreadable one, keep a timeline, cite every claim. Every other pack depends on it.

Ten artefact families: $MFT and the journals, the hives, execution evidence, the event logs and the records inside a cleared one, accounts and remote access, persistence, shell artefacts, browsers, shadow copies, memory, and what anti-forensics leaves behind.

The system profile and its timezone, auth.log and the systemd journal, accounts and the keys that need no account, persistence across all six cron locations and systemd timers, ext4's own creation time, containers, and the package database that says which binary was replaced.

Property lists in all three encodings, the unified log that replaced the text logs, FSEvents, the KnowledgeC activity database, launch items and the permissions TCC records, and what APFS snapshots keep that a deleted file does not.

What kind of extraction you were handed and what it therefore cannot contain, the iOS backup manifest that turns hash-named files back into a file system, Android packages and their installers, app databases and their write-ahead logs, location with its accuracy, and protobuf without a schema.

What the container is before anything is run against it, what a memory image gives you with no framework at all, processes and injected code, network state including the connections that had already closed, credential exposure, and how a capture is made.

What a capture can and cannot contain, session reconstruction, what survives encryption in DNS and the TLS handshake, finding something that calls home, exfiltration by volume, and tying any of it back to a machine.

Static triage under quarantine: what a file is from its bytes rather than its name, where it is packed, PE, ELF and Mach-O structure, the strings a sample hides from a plain search, capability mapping, documents and the references that fetch on open, and writing a rule that survives a recompile.

Which scheme this is, from the header: BitLocker and every key protector on it, LUKS key slots read with no key at all, FileVault, the container that leaves no signature on purpose, password-protected archives, and where the key already is.

Logs that belong to somebody else's computer: what each provider keeps and for how long, the Microsoft 365 unified audit log, Entra sign-ins, AWS CloudTrail, Google Workspace, and the tokens and consents that survive a password reset.

The order the case has to be worked in: scope, then what left before anything was encrypted, then entry and spread, then the encryptor. What was destroyed deliberately, what can actually be recovered, and the report a regulator, an insurer and a negotiator each need.

The shape most cases arrive in. Which collector made this, what its own log says failed, the paths it rewrote and how to map them back, what a logical acquisition can never contain, and what to ask for when the collection has not happened yet.

A working deployment on your own hosts, the guards your platform can actually enforce, and a first case run with your examiners watching. For a team that wants to adopt it without reading the repository first.

Writing the goal documents your casework needs, building the checks a finish line has to carry, and reading a completed run before it goes to a client or a court. The questions a reviewer will ask, asked first.

Your evidence, your questions, and the swarm run beside your own examiners. You keep the whole record: the board, the ledger, the trace and the report, with the hashes that let anyone replay it.