Releases

Transport-agnostic RPC framework built on Apache Arrow IPC

Offline C2PA verification command-line tool

Forensic anomaly auditor for archives — extension-vs-content masquerade, CRC/declared-size lies, path-traversal member names, decompression-bomb signatures — over archive-core.

4n6query — DFIR lookup tool: query LOL/LOFL binaries, abusable sites, and 6,548 forensic artifacts from the command line

Offline, verification-only C2PA SDK

Pure-Rust archive-layer reader for forensics: transparently peels gzip/bzip2/xz/zip/7z/tar archive layers to reveal the inner evidence, with extension-and-magic format detection.

C2PA validation engine used by the Encypher verifier

The ForensicNomicon — comprehensive DFIR artifact catalog: UserAssist, Shimcache, Amcache, Prefetch, $MFT, ShellBags, EVTX, NTDS.dit, SAM, SRUM, LNK, Jump Lists + KAPE/Velociraptor/Sigma/MITRE. Zero deps.

Static trust evaluation used by the Encypher C2PA verifier

Forensic-grade, from-scratch UDF (ECMA-167 / OSTA) reader and tamper analyzer — volume recognition, partition maps (physical/virtual/sparable/metadata), File Entry and directory (FID) traversal, file data, plus graded findings (tag CRC/checksum, orphan File Entries, slack, file-after-volume) over any Read + Seek source

Detection knowledge for the ForensicNomicon: the artifact descriptor catalog (the global CATALOG) and evidence/volatility lookups. The fast-moving data layer atop forensicnomicon-core.

(Internal) BES tooling: Tamanu library (config, discovery)

Asset-format readers used by the Encypher C2PA verifier

Cryptographic primitives used by the Encypher C2PA verifier

Proc-macros for vgi-rpc: #[service], #[unary], #[producer], #[exchange], #[derive(VgiArrow)], #[derive(StreamState)]

Stable engine layer of the ForensicNomicon: the normalized DFIR report model (Finding/Severity/Observation) and structural format constants. Zero deps.

C2PA data structures used by the Encypher verifier

CBOR encoding profiles used by the Encypher C2PA verifier

WhatsApp Desktop (Electron) analyzer — audits the IndexedDB-over-LevelDB `model-storage` for encrypted message bodies, recovered deleted-message tombstones, and media references, emitting normalized forensicnomicon findings. Panic-free, fuzzed.

Code-mode recall for Mnemo (v0.4.0 P0-3) — agents call recall as a sandboxed WIT function instead of a JSON tool, dropping per-turn token cost by ~95%.

WhatsApp Desktop (Electron) reader — interprets the Chromium IndexedDB-over-LevelDB store's decoded V8 values into typed chats, messages, contacts, and media metadata, plus a merged timeline. Panic-free, fuzzed; encrypted blobs are flagged, never fabricated.

Testcontainers helpers for the S2 Docker image

Forensic integrity analysis and repair for EWF (Expert Witness Format / E01) images

Pure Rust reader for Expert Witness Format (E01/EWF) forensic disk images

Generate small VCF test data with decoded ground truth, for property-based testing.

Safe Rust API for real-time audio on Bela Gem

Raw FFI bindings to the Bela core API (libbela) for Bela Gem

Dynamic Mode Decomposition with Koopman operator theory

An import-topology gate: declare the zones a package's imports may cross, and judge the real import graph against them.

CLI for S2