SIFT Sentinel — Autonomous Forensic IR Agent

An AI agent that autonomously finds evil on a forensic disk image — driving a SIFT Workstation through

Comment

🔍 SIFT Sentinel — Autonomous Forensic IR Agent

An AI agent that investigates a forensic disk image end-to-end — and finds the evil hiding on it.

We pointed it at the VANKO case (Case #20161104): a 119 GB physical disk image of a Microsoft Surface 3. With no human in the loop, the agent mounted the evidence, enumerated the machine, hunted for malware and anti-forensics, parsed event logs, and produced a confidence-scored, courtroom-ready report. It identified the operator as anthony.vanko@gmail.com and surfaced 8 findings — 2 critical, 4 high, 2 medium.

💡 Inspiration

Digital forensics is slow, manual, and gated by expertise. An analyst can spend hours just mounting an image, walking the registry, parsing Security.evtx, and correlating prefetch against downloads before they ever find the first real clue. We wanted to know: could an AI agent run the entire investigation itself — and explain every step well enough to stand up in court?

The "FIND EVIL!" challenge was the perfect proving ground: a real acquired disk image with real malicious activity to uncover.

🛠️ What it does

Given an E01 forensic image, the agent autonomously:

  1. Mounts the evidence read-only (ewfmount → kpartx → ntfs-3g)
  2. Enumerates users, OS, and timezone from the registry hives
  3. Hunts for executables in unusual locations (Temp, Roaming, Downloads)
  4. Parses Security.evtx for logon anomalies and ties activity to a real identity
  5. Hashes suspects and inspects their imports for exfiltration capability
  6. Confirms execution via Prefetch, and flags anti-forensics
  7. Writes a structured findings_report.json with severity, evidence, confidence, and recommended actions — plus a false_positive_notes section

What it found on VANKO

  • Unauthorized WiFi surveillance — a Starbucks packet capture, NetStumbler + Acrylic WiFi (execution confirmed by Prefetch)
  • Weaponization research — documents on weaponizing an ion thruster, DNA splicing, and rapid cell regeneration
  • Anti-forensics — SDelete placed in System32 and run; VeraCrypt installed with a FORMAT executed (hidden encrypted volume)
  • A dropper + a typosquatted exfil tool — set_PxRcHIFy.exe in Temp, and NETWIORK LICENSE SERVER 3.4.1.exe whose imports (HttpSendRequestW, FtpFindFirstFileA, requireAdministrator) betray HTTP/FTP exfiltration
  • Operator attribution — a security.evtx copied to the Desktop (counter-forensic self-monitoring) tied the activity to a real Gmail identity

🏗️ How we built it

┌─ Windows Host ───────────────────────────┐ │ orchestrator.py (agent loop, gpt-5.4-mini) │ sift-mcp (stdio MCP server, 18 tools) │ └──────────────┬────────────────────────────┘ │ SSH (asyncssh) ┌──────────────▼────────────────────────────┐ │ SIFT Workstation VM (Ubuntu 22.04) │ │ ewfmount → kpartx → ntfs-3g → /mnt/windows│ │ plaso · YARA · RegRipper · python-evtx │ └────────────────────────────────────────────┘

  • We wrapped the SIFT Workstation's forensic toolchain as a custom MCP server exposing 18 type-safe tools (mount_image, list_users, find_suspicious_executables, parse_evtx, yara_scan, get_run_keys, run_log2timeline, hash_file, …).
  • An orchestrator drives an autonomous loop over an OpenAI-compatible API (gpt-5.4-mini): the model decides which tool to call, reads the real result, self-corrects on errors, and converges on findings — logging every tool call and decision to a structured JSONL audit trail.
  • The host never copies the 119 GB image: we expose it to the VM via VMware shared folders and mount it strictly read-only to preserve chain of custody.
  • For the demo, the narration is generated entirely by VoxCPM2 running on a local GPU, and the "Live MCP Agent Session" scene replays a real session captured against the mounted image — every hash, import, and prefetch hit on screen is genuine. ## 🧗 Challenges we faced
  • 119 GB with no copying. Imaging into the VM was a non-starter. We solved it with VMware shared folders + a read-only FUSE mount.
  • Read-only everything. Evidence integrity is non-negotiable — the entire pipeline is engineered so the agent can read but never alter the original image.
  • Shell-quoting hell. Embedding Python EVTX parsers in SSH commands broke on quoting; we switched to uploading parser scripts via SCP and executing them remotely.
  • A real bug the agent exposed. Our find_suspicious_executables glob assumed an extra partition level (/mnt/windows/*/Users/*) and matched nothing on the directly-mounted partition. Capturing the live session for the demo caught it — fixed to find all 41 executables.
  • Dependency reality on Windows. Standing up the TTS stack on Python 3.13 meant routing around packages that don't build on Windows (pynini, editdistance) by exploiting their lazy imports. ## 📚 What we learned
  • MCP is a great fit for forensics. Modeling each forensic capability as a typed tool gave the agent a clean, auditable interface — and made the whole investigation reproducible.
  • Explainability beats cleverness. Confidence scores, cited evidence, and recorded false positives (e.g., confirming CNN.EXE was the legitimate Store app) are what make AI-driven forensics trustworthy.
  • Autonomy needs guardrails. Self-correction plus a complete audit log is what turns "an LLM calling tools" into a defensible investigation. ## 🚀 What's next
  • Volume Shadow Copy recovery + unallocated-space carving to recover what SDelete wiped
  • Automatic VirusTotal / MalShare enrichment for discovered hashes
  • A full log2timeline super-timeline correlated with findings
  • One-click HTML/PDF report export for analysts

Built With

  • asyncssh
  • ewf
  • ffmpeg
  • gpt-5.4-mini
  • log2timeline
  • mcp
  • model-context-protocol
  • ntfs-3g
  • openai
  • pillow
  • plaso
  • python
  • python-evtx
  • python-registry
  • regripper
  • sift-workstation
  • ubuntu
  • vmware
  • voxcpm
  • yara
Share this project:

Updates