-
-
The final output provided including findings.
-
Agent running using EvidenceChain.
-
All tests passed.
-
Self-Correction Log.
-
Threat Intel Enrichment.
What We Built
EvidenceChain is an autonomous digital forensics agent built on the SANS SIFT Workstation. You point it at a disk image or memory capture, and it investigates, sequencing 21 typed forensic tools, catching contradictions in its own findings, and producing a structured analyst report where every single conclusion links back to the exact tool execution that produced it.
The agent physically cannot hallucinate undetected. If a finding isn't supported by a verified tool call, it doesn't make it into the report.
What Inspired Us
Adversaries are now operating at machine speed. CrowdStrike's fastest observed breakout time is 7 minutes. Human responders are still pulling up their toolkit.
Protocol SIFT demonstrated that AI agents can orchestrate forensic tools. But it hallucinated too much to trust in a real investigation. We built the version you can hand a case to.
How We Built It
We built a custom Python MCP server that exposes 21 typed forensic functions instead of generic shell access. The agent can call get_amcache() or extract_mft_timeline(); it cannot run arbitrary commands. Every tool call returns a signed evidence receipt with a unique execution ID.
On top of that, we built a 4-pass self-correction engine with 7 contradiction detectors:
- Timestamp Paradox --> flags files created after they were supposedly executed
- Execution Overclaim --> catches findings that claim execution from presence-only evidence
- Ghost Process --> catches memory processes with no disk trace
- Timeline Gap --> detects suspicious gaps in event logs correlated with log-clearing events
- Attribution Mismatch --> flags SHA1 conflicts between Amcache and current file hashes
- Anti-Forensic Indicator --> detects timestomping, log clearing, and known anti-forensic tools
- Phantom Artifact --> our hallucination catcher, flags findings referencing non-existent atoms
When contradictions are found, the engine dispatches targeted re-runs automatically, up to 3 iterations, before finalizing the report.
For threat intelligence, we integrated 5 external sources: VirusTotal, AbuseIPDB, MalwareBazaar, LOLBAS, and AlienVault OTX, to enrich suspicious hashes, IPs, and process names found during the investigation.
The final output is a structured Markdown report with an executive summary, confirmed findings with evidence citations, a self-correction log, and a full IOC summary.
323 tests and 0 failures.
Challenges
The hardest part was getting forensic semantics right. A finding that claims a file was executed based only on Shimcache is wrong; Shimcache proves presence, not execution, on Windows 8 and later. We had to encode that kind of domain knowledge into the validation layer so the agent couldn't overclaim.
The self-correction engine also required careful design around convergence, making sure Re-investigation actually resolves contradictions rather than creating new ones, and building in hard iteration caps so the agent never runs away.
What We Learned
Architectural constraints beat prompt-based guardrails every time. The moment we stopped telling the agent what not to do and started building a server that structurally prevented it, the hallucination problem largely solved itself.
Forensic domain knowledge is the real moat. The tools are already on SIFT. The hard work is encoding 18 years of practitioner wisdom into the validation and contradiction layer.
What's Next
- Live endpoint triage via MCP-connected remote agents
- Multi-agent mode with specialized memory and disk analysts running in parallel
- Accuracy benchmarking against known-ground-truth datasets to measure improvement over the protocol SIFT baseline.
Log in or sign up for Devpost to join the conversation.