Copy evidence to SIFT VM and verify. Call this first.

Mount the E01 forensic image using ewfmount + kpartx. Required before any file-system analysis.

Unmount the forensic image cleanly after analysis.

Extract OS version, hostname, timezone from the mounted image.

List Windows user accounts discovered in the image.

List recently accessed files (LNK files) for a user.

Find executables in anomalous locations: Temp dirs, user AppData, ProgramData.

Read strings from a file on the mounted image (first 4KB).

Start log2timeline timeline creation (long-running). Poll with get_timeline_status.

Check if log2timeline is running; return last log lines.

Query the plaso timeline. Returns events sorted by time.

Parse a Windows registry hive. Optionally navigate to a specific key.

Extract Run/RunOnce autostart registry keys from all user hives.

Run YARA malware detection rules against a path in the mounted image.

Parse a Windows EVTX event log file.

Extract logon/logoff events (4624, 4625, 4634) from Security.evtx.

Extract prefetch files, hosts file, browser history paths.

Compute MD5 and SHA256 hash of a file on the mounted image.

Check hashes against local NSRL/malware hash database.