Forensic postmortem (DFIR)

Code

FAM-FORENSIC

Status

beta — code maturity

Availability

partial — whether it is offerable

Ingest

upload — how a target enters

Rules of Engagement

Not required

Kind

Family (a selectable assessment)

What happened in an incident and why — reconstructed from evidence, with correlation that is structural, never temporal coincidence.

It ingests a forensic bundle and reconstructs the kill-chain and timeline, correlating runtime activity to the code path responsible. Deliberately, there is no timestamp parsing — ordering is by sequence — so temporal proximity can never be promoted into a cause.

Root cause is confirmed only on two legs together: a verifier failure and a node-identity correlation that the runtime taint actually reached the finding’s sink. Without the analyst’s route map, activity stays NOVEL/UNKNOWN; the path is never invented.