forensicnomicon 0.5.6

The ForensicNomicon — comprehensive DFIR artifact catalog: UserAssist, Shimcache, Amcache, Prefetch, $MFT, ShellBags, EVTX, NTDS.dit, SAM, SRUM, LNK, Jump Lists + KAPE/Velociraptor/Sigma/MITRE. Zero deps.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

# Privacy Policy

*Last updated: 2026-06-15*

## Summary

forensicnomicon is a local Rust library and CLI. It does not collect, transmit, or store any personal data on remote servers.

## Data Access

forensicnomicon reads only the input you pass to it. The catalog is compiled in; all processing happens in memory on your local machine. Nothing is uploaded anywhere.

## Telemetry

forensicnomicon has **no telemetry**. It makes no network requests of any kind.

## Open Source

forensicnomicon is open source (Apache-2.0). You can audit every line of code at [github.com/SecurityRonin/forensicnomicon](https://github.com/SecurityRonin/forensicnomicon).

## Contact

Privacy questions: [security@securityronin.com](mailto:security@securityronin.com)

---

[Terms of Service](terms.md) · [Home](index.md) · © 2026 Security Ronin Ltd.