Digital Forensics Artifact Vault & Evidence Suite
Pillar 14 • Artifact DissectionDeep forensic triage across $MFT, Prefetch, ShimCache, Evtx logs, browser SQLite, and memory VAD allocations with court-admissible cryptographic chain of custody.
Target Evidence Image:
CRYPTOGRAPHIC CHAIN OF CUSTODY VERIFIED (SHA-256 MATCH)Federal Rule of Evidence 902(11) Compliant
Case: CASE-2026-DFIR-9042 • Examiner: Dr. Evelyn Reed (GCFA, EnCE, Tier-3 DFIR Lead)
Acquisition SHA-256: 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
Vault Vault ID: 04-DFIR-XTS
Hardware Encrypted HSM Enclave
Master File Table ($MFT) Timeline & Anti-Forensics Analysis
Compares Standard Information ($SI) and File Name ($FN) timestamps to detect anti-forensic timestomping.
| MFT Record # | File Path | Standard Info ($SI) Timestamp | File Name ($FN) Timestamp | Timestomp Alert | Size | Status |
|---|---|---|---|---|---|---|
| #48912 | C:\Windows\System32\tasksche.exe | 2017-05-12 07:05:42 | 2026-08-23 11:20:14 | $SI vs $FN Mismatch (Backdated) | 3.51 MB | Allocated |
| #48913 | C:\Users\Victim\Desktop\@Please_Read_Me@.txt | 2026-08-23 11:20:18 | 2026-08-23 11:20:18 | Normal | 1.42 KB | Allocated |
| #48914 | C:\Users\Victim\AppData\Local\Temp\passwords.tmp | 2026-08-23 11:20:22 | 2026-08-23 11:20:22 | Normal | 48.2 KB | Deleted / Carved |
| #48915 | C:\Windows\System32\mssecsvc2.0.dll | 2010-02-14 00:00:00 | 2026-08-23 11:20:15 | $SI vs $FN Mismatch (Backdated) | 842 KB | Allocated |