timbuktu

Incident response and digital forensics from the terminal. Analyze offline case data: source integrity, artifact identification, filesystem lifecycle, memory postmortems, log analysis and evidence-backed timelines.

Guarantees

  • Offline only — analyzes recorded case data; live acquisition is refused honestly
  • Evidence-backed forensic timeline: every entry carries source, observed_at and integrity
  • Deterministic rule engine across integrity, artifacts, filesystem, memory, logs and timelines
  • Risk scores are transparent: severity_weight × confidence × exposure, capped at 100

Install

git clone --depth 1 https://github.com/QYVORA/qyvora-timbuktu && cd qyvora-timbuktu && go build ./cmd/timbuktu

Usage

  • timbuktu assess --sim
  • timbuktu case --output case.json
  • timbuktu assess --case case.json
  • timbuktu timeline
  • timbuktu findings
  • timbuktu report -f json --out report.json