A local web app that gathers digital artifacts from your machine — browser history, USB events, execution traces — and lets you query them in plain English.
Not a feature list written for investors. Just the things that actually make this useful in the field.
One click. Browser SQLite databases, Windows registry, event logs, prefetch files, LNK recent-files, USB sysfs — all running concurrently and written to a local indexed database.
CONCURRENT EXECUTION"What USB devices were connected yesterday?" just works. The RAG engine parses intent, extracts date and type filters, and runs the SQL — no special syntax needed.
LOCAL LLM SUPPORTGenerates standalone, styled HTML reports — either just the filtered results from a query, or a full dump of everything collected. Self-contained, no dependencies to open.
DOWNLOAD READYOS detected at startup. Windows gets registry + event log collectors. Linux gets sysfs + journald collectors. The UI template even changes per OS automatically.
WINDOWS + LINUXSQLite on disk. Flask on localhost. Optional local LLM. Nothing phones home. Your artifact data doesn't leave the machine — ever. Zero telemetry by design.
OFFLINE CAPABLEWindows collectors run concurrently with ThreadPoolExecutor — 5 workers in parallel. WAL-mode SQLite ensures fast reads during parallel writes with zero locking issues.
THREADPOOLEXECUTORFive stages from raw OS data to a downloadable report. Clean pipeline, nothing magic.
Flask starts on 127.0.0.1:5000. It reads sys.platform, checks admin privileges, and picks the right template and collector set for the OS.
OS-specific collectors run — browser SQLite DBs, event logs, prefetch .pf files, LNK shortcuts, /sys/bus/usb, journald. Windows runs them concurrently.
Everything goes into a WAL-mode SQLite database across 8 indexed tables. Thread-safe writes. Fast reads. Stays on disk until you re-collect.
HybridRAG parses natural language — extracts dates, artifact types, browser names — and translates to filtered SQL against the local DB.
Results render in the UI with an optional LLM summary. One click exports a self-contained HTML file — full report or query-specific.
Platform-aware. Each OS gets the collectors that actually work on it — no wasted runs.
Nothing exotic. Chosen for reliability and zero deployment friction.
The query engine doesn't need special syntax. Type the way you'd ask a colleague — it figures out what you mean and returns the right data.
Each package contains two things: the /models folder (LLaMA 3.2 GGUF) and the software installer for your platform. Unzip and run.
Everything in one archive. The software installers for both Windows and Linux, plus the /models folder pre-loaded with llama-3.2-3b-instruct-q4_k_m.gguf. Unzip, pick your platform, run.
Windows 10 / 11 — 64-bit
Ubuntu 20.04+ / Debian / Kali
Run locally. No cloud. No telemetry. Your forensic data stays exactly where it should — on your machine.