$ loading_
Investigate disk and memory evidence with adversarial AI agents for DFIR.
Copy the install command and let the AI configure it · recommended for beginners
No copy-paste install info for "EvidenceGene Court" yet — see the docs or source repo.
Using the read-only disk image and memory evidence, have the Prosecutor propose an intrusion-chain hypothesis, the Defender challenge weak evidence, and the Arbiter deliver a final judgment with verifiable IOCs, a timeline, and high-risk processes.
A structured forensic report with the attack timeline, key evidence, disputed points, IOC list, and final ruling.
For a suspicious process found in memory, analyze its parent-child process tree, loaded modules, network connections, and persistence clues; use an adversarial prosecutor-defender review to assess whether it is malware and state the confidence level.
A pro-and-con assessment of the process, evidence strength analysis, and a confidence-scored malware verdict.
Summarize this disk and memory forensic investigation as a case review: include the investigation goal, key findings, evidence sources, unresolved questions, and recommended next steps for a security team lead.
A concise review summary for a team lead, suitable for communicating conclusions and next actions.
Turn the SIFT toolchain into evidence-safe, auditable DFIR MCP workflows.
Turn AI into an autonomous DFIR analyst on SANS SIFT.
Enables AI to perform forensic triage on compromised hosts with evidence safeguards.
Automate disk image forensics, malware scanning, and courtroom-ready reporting.
Analyze files and browser artifacts for malware and security investigations.
Conduct forensic investigations with evidence-linked, verifiable analysis and reduced hallucinations.