Extract metadata from a forensic evidence file. Runs the real file --brief --mime-type command to detect the actual MIME type, compares it against the file extension using a bundled magic-byte signature database to detect MIME/extension discrepancies, runs ExifTool to extract embedded metadata (camera, GPS, timestamps, dimensions), and computes a streaming SHA-256 hash of the file. Use this tool for metadata extraction, MIME-disguise checks, and file hashing. All results come from actual command execution against the file bytes — no fixtures or mocks.

Extract readable strings from a forensic evidence file using the real GNU strings -n 6 command. Scans the actual command output for suspicious patterns including IPv4 addresses, URLs, domains, and suspicious keywords (cmd.exe, powershell, base64, Invoke-Expression, certutil, rundll32, etc.). A keyword hit is an indicator, not proof of malware. Results are bounded to prevent oversized responses. Use this tool to find embedded text, URLs, and potential indicators in binary files.

Analyze a Windows memory dump using the installed Volatility binary. Runs Volatility plugins sequentially: windows.info (OS/kernel details), windows.pslist (process list), windows.netscan (network connections), and windows.malfind (injected/code-hinting regions). Each plugin result independently reports success, failure, or unavailability — a single plugin failure does not fail the entire analysis. Designed for Windows memory dumps because the required plugins are Windows-specific. A malfind result requires analyst review — it is an indicator, not proof of malware. No forensic results are fabricated; if Volatility cannot parse the dump, real failure output is returned.