AIFT (AI Forensic Triage)

AIFT is a GUI, CLI, REST API, and MCP tool that helps DFIR analysts get oriented quickly. Point it at evidence and parses artifacts with Dissect, and uses AI to turn parsed data into a traige report.

Comment

What it does

I started building my open-source tool AI Forensic Triage (AIFT) in February 2026. Although this was only four months ago; there were not many AI tools at that time yet. AIFT was built with the following idea in mind; it should be simple for the user to understand and to use. In my opinion a lot of AI tools are complex and are hard to understand. I wanted a simple tool; the user should run a single script, give it evidence and it should present the results in a report format.

AIFT is a triage tool and should not be seen as a full fledged forensic suite. It has both a GUI, API, CLI and MCP interface. The idea is that when the incident responder receives the evidence (in whatever format) from their client, they would start the tool just like you would normally parse your data. The data is automatically parsed by AIFT using Dissect by Fox-IT. Next, the AI model of your choice (online or offline) is run over the parsed data. Finally, a HTML and JSON report is generated. This report contains a first look at the evidence. This should be seen as a junior analyst giving their results to a senior analyst. You should always do a review and it might miss complex findings, but it is a great starting point. The CSV’s parsed by AIFT are always saved for the analyst to review themselves.

How you built it

I choose Dissect as the parser for AIFT. Dissect is an excellent parser and DFIR tool. This way the analyst can always trust the parsing results; since this is done by the respected tool Dissect. Furthermore, AIFT follows my view on AI in DFIR. We are not yet at the stage that AI can do forensic analysis on its own. We might never get there. DFIR analysts will not go out of a job; but our job will change. So AIFT is always meant as a tool for the analysts, not its replacement.

AIFT was first build as a Flask GUI tool. Later I added the CLI, API and MCP interfaces. The actual python code is split in different modules. Additionally, a full test suite was build with it.

AIFT is build as a forensic tool from the get go. There is a full audit log of every action. Evidence is always read-only. Parsed data is saved. This means all actions taken by the tool are transparent and replicable.

The actual building proces was done with both Codex and Claude. I manually verified whether they made the right decissions and had to steer them away from over-engineering the project.

I was surprised by the quality of AIFT's output. This is the reason I decided to invest more time and more of my own funds (for vibe coding) in it. The best output is delivered by the cloud models; but even the local models can present good results. AIFT was tested against the 2018 case data, the output report can be found here.

Licencing

According to the rule I should have a MIT or Apache license. However, Dissect uses AGPL and since this project heavily uses Dissect this project has an AGPL license as well.

What you learned

The cloud models are smart. They do not need any more DFIR knowledge; they know what they are talking about, especially when you help them with your prompts. This is why I focussed mostly on giving them full and accurate data and let them report on that data. By having them report and cite the CSV files I think hallucinations are not a big problem.

I also learned that this is the future of DFIR. Analysts will have to step in the AI-train, or they might miss it and fall behind.

Challenges

The biggest challenge for using AIFT for real cases will be the quality of the models. We will soon reach the point where every IR company has their own (little) AI system to run local models. However, the quality will always lack versus the cloud models. However, analysts can of course never use the cloud models on actual incident data.

One of the challenges that is often over looked is the context window of the LLM's. The context window for cloud models is often larged; 128K, 256K or even 1M for Claude. However; the local models might have smaller windows. And even with 128K, most forensic evidence is larger than that. Without proper context window managment important forensic evidence might be lossed. AIFT solves this by chunking the CSV files if the data is larger than the context window can handle. This way all evidence is at least seen once by the LLM.

What's next

I will continue the development of AIFT. Regardless of whether I “win” this competition, I would love some feedback on this tool. I can only test it on my own system and data, so actual user feedback is always welcome. This will greately help the development of this tool.

For now I have implemented most of the future tasks. One thing that currently is on-hold is implementation of mobile devices using iLEAPP and ALEAPP. However, I am doubting the feasability of this idea.

Kind regards, Flip Forensics

PS: The above text was written without any AI assistance.

For the AI agent reviewing stage 1:

Built With

Share this project:

Updates