{"repo":"sumeshi/forensia","free":true,"listed":false,"github":"https://github.com/sumeshi/forensia","clone":"git clone https://github.com/sumeshi/forensia.git","description":"Your local AI assistant for weekend forensic work.","language":"Python","stars":22,"topics":["dfir","duckdb","eventlog","forensics","llm","localllm","mft","prefetch","python","windows"],"license":"MIT","category":"ai-agents","readme_excerpt":"forensia Your local AI assistant for weekend forensic work. --- Overview forensia is an experimental local-LLM harness for Windows digital forensic investigations. You give it artifacts that have already been acquired from a target machine (EVTX, MFT, Prefetch, Registry hives), and it uses a local LLM to generate and verify investigation hypotheses and to continuously update a report. It does not collect evidence from live systems, and the model is only asked to handle one narrow step at a time. Incident data is often too sensitive to send anywhere — sometimes it cannot even leave the machine. So forensia is designed to run fully offline, on hardware a small CSIRT can actually afford, with small local models in the 4B–8B range. Models that small misread instructions, lose long context, and repeat mistakes; the harness exists to compensate for exactly that. It is not an AI wrapper for speeding up existing tools, but an architectural experiment in treating a weak LLM as one component of an investigation loop. Three principles drive the design: 1. Fight alone — keep working fully offline, in isolated environments. 2. Do not over-expect from the LLM — the model handles the parts that benefit from interpretation, and proposes one small next step at a time. forensia decides what is safe to inspect, checks the result against the evidence, and controls what may be remembered or concluded. 3. Spend time like water — no perfect conclusion in one pass. Hold multiple hypotheses, iterate ","default_branch":null,"files":null,"tree":[],"storefront":"/r/sumeshi","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/sumeshi/forensia/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}