Skip to content

README.md

Latest commit

 

History

History
108 lines (75 loc) · 4.81 KB

README.md

File metadata and controls

108 lines (75 loc) · 4.81 KB
Raw
# Deleted File Investigation Assistant — Offline Digital Forensics Tool

[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
[![Python 3.12+](https://img.shields.io/badge/python-3.12+-blue.svg)](https://www.python.org/downloads/)
[![Offline](https://img.shields.io/badge/mode-offline%20first-important.svg)](#)
[![secintel](https://img.shields.io/badge/schema-secintel%20v1-purple.svg)](https://github.com/reshot2005/secintel-core)
[![GitHub](https://img.shields.io/badge/github-reshot2005%2Fdeleted-file-investigation-assistant-black.svg)](https://github.com/reshot2005/deleted-file-investigation-assistant)

> **Signature-based file carving over disk-image exports — recover deleted files for DFIR investigations offline.**

**Category:** Digital Forensics  
**Collection phase tool:** 8/10  
**Schema:** [secintel-core](https://github.com/reshot2005/secintel-core) v1  
**Repository:** https://github.com/reshot2005/deleted-file-investigation-assistant  
**Author account:** [reshot2005](https://github.com/reshot2005)

## Why Deleted File Investigation Assistant ranks for security search

Deleted File Investigation Assistant is an **offline-first**, research-grade **digital forensics** utility designed for practitioners who need reproducible analysis without uploading sensitive artifacts to SaaS scanners. It emits structured findings through the shared **secintel** evidence taxonomy (OBSERVED / DERIVED / INFERRED / CORRELATED / VERIFIED) so results are auditable, exportable, and CI-friendly.

### Primary SEO keywords
`file carving, deleted file recovery, disk image forensics, data carving, DFIR recovery`

### Topics
`digital-forensics` `dfir` `incident-response` `cybersecurity` `forensics` `threat-hunting` `security-tools` `python` `offline-security` `blue-team` `file-carving` `recovery`

## What problem does this solve?

Assist deleted-file investigations using signature-based carving over disk image exports without live cloud services.

Assistant-style carving workflow with structured output.

## Key features

- Signature-based carving

  • Disk-export oriented

  • Recovered artifact inventory

  • Investigation assistance

  • Offline operation

    Ideal use cases

    • Recover deleted evidence

  • Carve images from dumps

  • Support spoliation analysis

    Who should use this

    • Security engineers & AppSec / NetSec specialists
    • SOC / DFIR / malware analysts (as applicable)
    • Bug bounty hunters and penetration testers
    • DevSecOps teams needing offline/air-gapped tooling
    • Students and researchers learning digital forensics

    Quick start

    git clone https://github.com/reshot2005/deleted-file-investigation-assistant.git
cd deleted-file-investigation-assistant
python3.12 -m venv .venv
source .venv/bin/activate  # Windows: .venv\Scripts\Activate.ps1
pip install -e ../secintel-core  # or: pip install -e git+https://github.com/reshot2005/secintel-core.git#egg=secintel-core
pip install -e ".[dev]"

deleted-file-investigation-assistant analyze sample_data --json
deleted-file-investigation-assistant analyze sample_data --html report.html
deleted-file-investigation-assistant version

    Exports for interoperability

    deleted-file-investigation-assistant analyze sample_data \
  --json --html report.html --csv findings.csv --sarif results.sarif

    Evidence quality & reproducibility

    • Findings follow secintel classification rules (confidence only where schema allows).
    • Provenance includes tool version, config hash, and input integrity metadata.
    • Set SECINTEL_SOURCE_DATE_EPOCH for deterministic timestamps in CI.
    export SECINTEL_SOURCE_DATE_EPOCH=1704067200
deleted-file-investigation-assistant analyze sample_data --json

    Development

    ruff check src tests
mypy src
pytest

    Related tools in this collection

    Browse more offline security research tools by reshot2005: network security, web AppSec, DevSecOps, digital forensics, and static malware analysis — each in its own public repository with the same secintel reporting contract.

    License

    MIT — free for research, education, and commercial use with attribution preserved.

    Discoverability blurb (search engines & GitHub)

    Deleted File Investigation Assistant (deleted-file-investigation-assistant) — Signature-based file carving over disk-image exports — recover deleted files for DFIR investigations offline. Search terms: file carving, deleted file recovery, disk image forensics, data carving, DFIR recovery. Open-source, MIT-licensed, Python 3.12, offline cybersecurity tool by reshot2005.