$ loading_
Investigate disk and memory evidence with adversarial AI agents for DFIR.
Copy the install command and let the AI configure it · recommended for beginners
No copy-paste install info for "EvidenceGene Court" yet — see the docs or source repo.
Using the read-only disk image and memory evidence, have the Prosecutor propose an intrusion-chain hypothesis, the Defender challenge weak evidence, and the Arbiter deliver a final judgment with verifiable IOCs, a timeline, and high-risk processes.
A structured forensic report with the attack timeline, key evidence, disputed points, IOC list, and final ruling.
For a suspicious process found in memory, analyze its parent-child process tree, loaded modules, network connections, and persistence clues; use an adversarial prosecutor-defender review to assess whether it is malware and state the confidence level.
A pro-and-con assessment of the process, evidence strength analysis, and a confidence-scored malware verdict.
Summarize this disk and memory forensic investigation as a case review: include the investigation goal, key findings, evidence sources, unresolved questions, and recommended next steps for a security team lead.
A concise review summary for a team lead, suitable for communicating conclusions and next actions.
Enables AI to perform forensic triage on compromised hosts with evidence safeguards.
Perform read-only disk image triage with self-verifying, tamper-resistant forensic analysis.
Analyze files and browser artifacts for malware and security investigations.
Query persistent evidence memory for structured reverse engineering investigations.
Analyze memory dumps for forensic investigations with fast, plugin-rich workflows.
Wrap forensic CLI tools into MCP for automated evidence analysis workflows.