mulder

Run multiple tool calls in parallel and return all results.

Run a single Volatility 3 plugin against a memory dump and index the output.

Extract browser history from Chrome, Firefox, and Safari databases.

Extract and parse macOS plist files from a disk image.

Extract a SQLite database from a disk image and run a SQL query.

List files and directories at a given path.

Read a text file from the evidence directory.

Scan image files for hidden steganographic content.

Extract hidden data from a steganographic JPEG image.

Analyze MFT data for files with manipulated timestamps (timestomping).

Parse Sysinternals Autoruns CSV output to identify persistence mechanisms.

Search the MITRE ATT&CK knowledge base for techniques.

Triage a binary using rabin2 for forensic analysis.

Identify capabilities in a binary using Mandiant CAPA.

Extract obfuscated strings from a binary using FLOSS.

Identify packers, compilers, and protectors using Detect-It-Easy.

Retrieve IOC data carved by bulk_extractor from the case database.

Scan an evidence directory and create a new case for investigation.

List all cases in the database directory.

Switch the active case to an already-existing case.

Verify the integrity of all indexed source data.

Extract a compressed evidence archive to make its contents accessible.

Analyze Windows artifacts using Chainsaw with Sigma rules.

List all evidence sources currently indexed in the active case.

Return per-source statistics including citation coverage.

Cross-reference all evidence sources within a time window.

List all processes captured in the memory dump (Volatility pslist).

Return the process parent-child tree from memory (Volatility pstree).

Find anomalous entries in a Windows Event Log channel.

Extract the Plaso super-timeline for a time range.

Return all parsed Windows Prefetch data.

Return parsed AmCache / registry system hive data.

Detect processes hidden from the linked list by comparing psscan against pslist.

Return environment variables for a specific process from memory.

Return token privileges for a specific process from memory.

Detect hidden kernel modules by comparing modscan (pool-tag) against modules (linked list).

Return UserAssist registry entries extracted from memory.

Return a summary of file objects cached in the memory dump (Volatility filescan).

Retrieve full raw text from a specific evidence source with cursor pagination.

Safely decode an encoded payload found in evidence.

Bookmark a specific window for later review.

Retrieve all bookmarked windows with their notes.

Remove a bookmark by ID.

Return a reference guide of available forensic tools and their relationships.

Analyze a Microsoft Office document for malicious content.

Analyze a PDF file for malicious indicators.

Parse Outlook PST/OST files for forensic email analysis.

Enrich IOCs against public threat intelligence APIs.

Return MFT entries within a time range, parsed by MFTECmd (EZ Tools).

Return USN Journal entries within a time range, parsed by MFTECmd (EZ Tools).

Record a forensic finding with validated evidence references and metadata.

Update or correct an existing finding.

Delete a finding that was submitted in error.

Submit the long-form investigation narrative report.

Generate the final investigation report from all submitted findings.

Identify and consolidate duplicate findings across systems.

Detect threats in EVTX files using 3,700+ Sigma rules via Hayabusa.

Analyze Chrome/Chromium browser artifacts using Hindsight.

Submit long-running extraction tools for background execution and return immediately.

Poll the progress of a background extraction batch.

Retrieve extraction summaries from completed background jobs.

Wait for multiple extraction batches to complete simultaneously.

Wait for extraction batches or individual jobs to complete.

Scan Android device backup for spyware indicators using MVT.

Scan iOS backup or filesystem dump for spyware indicators using MVT.

Carve SQLite databases from a raw binary image (phone dump).

Parse Android artifacts from a logical extraction or carved databases.

Parse iOS artifacts from an iTunes/Finder backup or extracted files.

Attempt to decrypt and parse application data.

Parse Android forensic artifacts using ALEAPP.

Parse iOS forensic artifacts using iLEAPP.

Return Plaso parser hit statistics collected during ingest.

Query the Plaso timeline with time range and optional filters.

Export a 5-minute timeline slice centred on a timestamp.

Identify indexed evidence sources not cited by any submitted finding.

Report applicable forensic tools that were never invoked during the investigation.

Check whether the investigation meets all finalize_report requirements.

Record investigation progress for a specific system.

Extract and deduplicate IOCs from findings and bulk_extractor data.

Return the partition table extracted from the disk image (TSK mmls).

List files from the disk image filesystem (TSK fls).

Return a summary of deleted files detected in the disk image.

Return the filesystem timeline (mactime) within a time range.

Extract a file from the disk image by inode number using TSK icat.

Return file metadata (MAC times, size, blocks) for an inode using TSK istat.

Scan a mounted filesystem or extracted directory for malware using YARA rules.

Scan the memory dump with YARA rules for malware signatures.

Scan process virtual address descriptors with YARA via Volatility 3's vadyarascan.

Apply Sigma detection rules to Linux logs using Zircolite.

Build a unified execution evidence view from multiple artifact sources.

Build a unified execution timeline from prefetch, amcache, and shimcache.

Detect potential data exfiltration by correlating network, URL, and file access artifacts.

Detect signs of data staging and exfiltration preparation in filesystem data.

Detect lateral movement by correlating logon events, network connections, and RDP artifacts.

Detect defense evasion techniques across memory, filesystem, and event logs.

Reconstruct parent-child process execution chains from memory forensics.

Assess evidence recoverability by cross-referencing deleted files, carving results, and anti-forensics indicators.

Cross-reference PCAP network events with host artifacts.

Detect persistence mechanisms across registry, services, event logs, and timeline.