Enables AI-assisted Windows digital forensics analysis including parsing Windows Event Logs (EVTX), analyzing registry hives (SAM, SYSTEM, SOFTWARE), and remotely collecting artifacts via WinRM with built-in security queries and forensic reference data.
Enables digital forensic analysis of Windows shortcut (LNK) files from E01 disk images. Supports automatic partition detection, LNK file extraction, metadata parsing, and timeline analysis through MCP-compatible agents.
Enables context-aware EVTX hunting with process lineage tracing and rarity baselining to surface real threats from security logs, transforming raw alerts into actionable kill chain intelligence.
Provides read-only access to local iMessage databases on macOS for searching message history and analyzing conversation patterns. It includes 25 tools to explore contacts, attachments, reaction statistics, and messaging trends through natural language queries.
