Forensic knowledge as code — zero-dependency, std-only, embeds in any Rust binary.

• DFIR Handbook
• Module Source Map
• Canonical Source Inventory
• Windows IR Archive Index
• GitHub Pages / API docs: https://securityronin.github.io/forensic-catalog/

[dependencies]
forensic-catalog = "0.1"

use forensic_catalog::ports::is_suspicious_port;
use forensic_catalog::catalog::{CATALOG, TriagePriority};

// Instant port check — no allocations
assert!(is_suspicious_port(4444)); // Metasploit default

// Pull every Critical-priority artifact, sorted for triage
let critical: Vec<_> = CATALOG
    .for_triage()
    .into_iter()
    .filter(|d| d.triage_priority == TriagePriority::Critical)
    .collect();

The catalog module is the power feature. Every artifact descriptor is a const-constructible ArtifactDescriptor — MITRE ATT&CK tags, triage priority, retention period, cross-correlation links, and embedded decode logic all in one static struct. No I/O, no allocation until you query.

use forensic_catalog::catalog::CATALOG;

// All artifacts relevant to process injection
let artifacts = CATALOG.by_mitre("T1055");
for d in &artifacts {
    println!("{} — {}", d.id, d.meaning);
}

let ordered = CATALOG.for_triage(); // Critical → High → Medium → Low
for d in ordered.iter().take(10) {
    println!("[{:?}] {} — {}", d.triage_priority, d.id, d.name);
}

let hits = CATALOG.filter_by_keyword("prefetch");
// matches on name or meaning, case-insensitive

use forensic_catalog::catalog::{ArtifactQuery, DataScope, HiveTarget};

let hits = CATALOG.filter(&ArtifactQuery {
    scope: Some(DataScope::User),
    hive: Some(HiveTarget::NtUser),
    ..Default::default()
});

use forensic_catalog::catalog::CATALOG;

let descriptor = CATALOG.by_id("userassist").unwrap();
let record = CATALOG.decode(descriptor, value_name, raw_bytes)?;
// record.fields — decoded field name/value pairs
// record.timestamp — ISO 8601 UTC string, if present
// record.mitre_techniques — inherited from the descriptor

• Zero dependencies — Cargo.toml has no [dependencies]. No transitive supply-chain risk.
• No I/O — every function operates on values passed in. Reading files, registry, or memory is the caller's job.
• const/static-friendly — ArtifactDescriptor and all its enums are constructible in const context. Extend the catalog at compile time.
• Test-driven — every indicator table has positive and negative test cases. Run cargo test to verify coverage.
• Additive — each module is independent. Pull in only what you need.

This project is a forensic catalog first, not a full DFIR parsing engine.

• Parsing knowledge is layered:
• ContainerProfile models how to open and enumerate the outer container such as an offline Registry hive, SQLite database, EVTX log, OLE compound file, or memory image.
• ContainerSignature models how to recognize or carve that container from raw bytes in unallocated space or memory.
• ArtifactDescriptor identifies where the artifact lives inside that container or on disk.
• ArtifactParsingProfile captures artifact-specific semantics such as UserAssist ROT13 or BITS job reconstruction.
• RecordSignature models how to recognize or validate individual records or payloads inside a container, including carved fragments.
• Decoder is reserved for compact, stable transforms we can safely implement in-core.
• Keep ArtifactDescriptor for artifact location, significance, field schema, ATT&CK mapping, triage value, and authoritative citations.
• Keep ArtifactParsingProfile for format knowledge and analyst guidance that does not fit a small stable decoder.
• Implement in-core decoders only for compact, stable encodings where the logic is intrinsic to the artifact model, such as UserAssist, MRUListEx, FILETIME, REG_MULTI_SZ, or PCA record layouts.
• Do not keep pushing large or evolving formats such as hiberfil.sys, BITS job stores, or full WMI repository parsing into this crate's core decode engine.
• If execution-grade parsers are needed later, put them in a separate parsing module or companion crate rather than turning the catalog itself into a full parser framework.

The repository keeps DFIR knowledge in multiple linked layers: source corpus inventory, module-level references, artifact descriptors, parsing guidance, and carving/signature guidance.

flowchart TD
    A[Curated DFIR Source Corpus] --> A1[archive/sources/manual-sources.json]
    A --> A2[archive/sources/catalog-directories.json]
    A --> A3[archive/sources/dfir-feeds.opml]
    A1 --> B[scripts/normalize_sources.py]
    A2 --> B
    A3 --> B
    B --> C[archive/sources/source-inventory.json]
    C --> D[src/references.rs]
    C --> E[docs/module-sources.md]
    D --> F[ModuleReference]
    E --> G[Maintainer Docs]
    C --> H[src/artifact.rs]
    H --> I[ArtifactDescriptor]
    H --> J[ContainerProfile]
    H --> K[ContainerSignature]
    H --> L[ArtifactParsingProfile]
    H --> M[RecordSignature]
    I --> N[CATALOG API]
    J --> N
    K --> N
    L --> N
    M --> N

flowchart TD
    A[Raw Bytes or Acquired Files] --> B[ContainerSignature]
    B --> C[ContainerProfile]
    C --> D[ArtifactDescriptor]
    D --> E[ArtifactParsingProfile]
    E --> F[Decoder]
    D --> G[RecordSignature]
    G --> E
    F --> H[ArtifactRecord]

UserAssist is the canonical example:

• ContainerSignature: Registry hive carving guidance like regf, hbin, nk, and vk
• ContainerProfile: open NTUSER.DAT as an offline Registry hive
• ArtifactDescriptor: locate UserAssist\\{GUID}\\Count
• ArtifactParsingProfile: ROT13 the value name and interpret the Count payload
• RecordSignature: validate the 72-byte UserAssist Count payload when carving fragments
• Decoder: perform the actual ROT13 and binary field extraction

Module-level research provenance is available through forensic_catalog::references.

use forensic_catalog::references::module_references;

let refs = module_references("persistence").unwrap();
assert!(refs.urls.iter().any(|url| url.contains("attack.mitre.org")));

Artifact-level provenance remains embedded directly in the catalog:

use forensic_catalog::catalog::CATALOG;

let desc = CATALOG.by_id("userassist_exe").unwrap();
assert!(!desc.sources.is_empty());

• RapidTriage — live incident response triage tool