Evidence Attribution Pipeline

Inspiration

Digital forensic investigations are time-consuming and require expert knowledge. Analysts manually sift through gigabytes of disk images, memory dumps, and logs to find malicious activity. We wanted to automate this process while maintaining forensic rigor — every finding must be traceable to specific evidence.

What it does

Evidence Attribution Pipeline is an autonomous forensic AI agent that:

Ingests disk images (E01), memory dumps, network captures, and log files
Extracts artifacts using real SIFT forensic tools (fls, icat, strings, tshark, Volatility3)
Builds a chronological timeline of suspicious events
Uses Claude AI with adaptive thinking to reason over the evidence
Verifies every hypothesis against the raw evidence before reporting
Maps findings to MITRE ATT&CK techniques with confidence scoring
Correlates findings across multiple hosts to identify lateral movement
Produces a professional incident report with executive summary, attack timeline, and recommended actions

How we built it

Built on the SANS SIFT Workstation using Claude Code as the agentic framework. The pipeline is modular — 12 Python modules each handling one stage. Claude API with adaptive thinking reasons over structured forensic timelines and generates hypotheses. Each hypothesis is then verified using subprocess calls to SIFT tools before appearing in the final report.

Challenges

Parsing NTFS filesystems from E01 images without partition tables
Preventing the LLM from hallucinating file paths that don't exist
Keeping API token usage under rate limits with large disk images
Distinguishing legitimate Chocolatey from trojanized versions

What we learned

Real forensic evidence is messy. The SANS SRL-2018 dataset showed that attackers abuse legitimate tools (Chocolatey) making detection harder than synthetic test cases.