ARGUS7by OSINTLAB360
IN SVILUPPO
IT/EN

CORE v1.0 · MODULE 06

ARGUS7 / DIGITAL EVIDENCE WORKBENCH

Forensics

Preservare master evidence, working copy, hash, artefatti, timeline, parent/child e chain of custody.

Apri workbench ↓Architettura completa ↗
INPUTSOURCEMODULE ANALYSISEVIDENCEHUMAN REVIEWOUTPUT

01 / DIGITAL EVIDENCE WORKBENCH

Ogni elemento visualizzato deriva dal dataset del caso.

Zoom, pan, filtri, selezione e dettaglio espongono entità, relazioni, Source ID ed Evidence ID. Nessuna rotazione automatica o dato casuale.

MASTER EVIDENCECFREDS-REF-001READ ONLY · SOURCE VERIFIED
WORKING COPYWC-001DERIVED · HASH REQUIRED
ARTIFACTAF-001FILESYSTEM
EVENTEVT-002TIMELINE
REPORT ITEMRI-003HUMAN REVIEW

02 / MODULE SPECIFICATION

Scopo, responsabilità e confini operativi.

La pagina mantiene nomi, agenti, routing e dipendenze della baseline ARGUS7.

PURPOSE

Preservare master evidence, working copy, hash, artefatti, timeline, parent/child e chain of custody.

PROTOTYPE
AINPUTS

INPUTS

  • Immagine forense
  • File e log
  • Output Cyber
  • Metadati di acquisizione
BPROCESS

PROCESS

  • Acquisition
  • Hash verification
  • Artifact extraction
  • Timeline normalization
  • Derived evidence creation
CACTIVATED AGENTS

ACTIVATED AGENTS

  • Forensic Agent locale
  • Anomaly Timeline Analysis
  • HITL Validation
DTOOLS / SOURCES

TOOLS / SOURCES

  • Tool forensi locali
  • CFReDS
  • Evidence Management
  • Project Memory / RAG
EVALIDATION / EVIDENCE

VALIDATION / EVIDENCE

  • Master evidence immutabile
  • Hash per trasformazione
  • Ripetibilità
  • Chain of custody
FOUTPUT

OUTPUT

  • Evidence tree
  • Artifact timeline
  • Chain-of-custody log
  • Forensic report
CONNECTED MODULES / COMPONENTS
VisionCyberInvestigationsEvidenceReport

03 / EVIDENCE ↔ INTERPRETATION

Il linguaggio del controllo segue la funzione del modulo.

Non viene forzata una coppia ATTACK ↔ DEFENSE dove non avrebbe significato investigativo.

EVIDENCE
  • Master
  • Working copy
  • Hash
  • Chain of custody
INTERPRETATION
  • Artifact
  • Timeline
  • Derived item
  • Finding support

04 / CONNECTED CASES

Il modulo non opera in isolamento.

Gli stessi case study attraversano più moduli, con un unico modello dati e la stessa catena di evidenza.

CASE-CY-2023-001INTERACTIVE DEMONSTRATION

REAL PUBLIC CYBERSECURITY CASE

MOVEit Transfer / CL0P

5 EVIDENCE · 4 RELATIONSHIPSCyber · Intel · Investigations · Graph · Forensics · Research · Strategy
CASE-SC-2024-003INTERACTIVE DEMONSTRATION

REAL SOFTWARE SUPPLY-CHAIN CASE

XZ Utils / CVE-2024-3094

5 EVIDENCE · 4 RELATIONSHIPSResearch · Cyber · Forensics · Intel · Graph · Investigations · Strategy
CASE-DF-2026-004FORENSIC BENCHMARK

FORENSIC BENCHMARK / DOCUMENTED SIMULATED EVIDENCE

NIST Forensic Lab

4 EVIDENCE · 4 RELATIONSHIPSVision · Forensics · Investigations · Graph · Evidence Pipeline