Module render 

Human view: a readable results grid (one block per device). The machine view is to_jsonl — faithful and round-trippable; this view renders for eyes (datetimes formatted, consistency labelled, values unwrapped).

Functions

format_epoch

Format a Unix-epoch-seconds timestamp as YYYY-MM-DD HH:MM:SS UTC.

render_accessed_files

Render the opened/accessed-files report: for every device with recovered file accesses (LNK/jump-list AccessedFile claims), the files opened from it, each with its source locator. This answers “which files were touched on which stick” — the exfil view. A device with no file accesses is omitted; the whole report is empty when none were found.

render_report

Render a court-oriented Markdown forensic report: an executive summary, a per-device provenance table (every value with its source and locator), the graded findings, and a methodology/limitations note. Convert to PDF/DOCX downstream (e.g. pandoc).

render_table

Render device histories as a human-readable results grid.