This commit is contained in:
2025-12-22 16:18:12 +01:00
parent adca7b7a2c
commit 0a8764a4bc

View File

@@ -8,9 +8,9 @@ Cryptographically Secured Forensic Logging Utility
## ABSTRACT ## ABSTRACT
**Factum-Notes** is a specialized software utility designed for the rigorous documentation of digital forensic investigations. It addresses the critical requirement for data integrity within the chain of custody by offering immediate cryptographic signing of all analyst entries, while this is optional and configurable by the analyst. **Factum-Notes** is a note-taking application built for the demands of a forensic investigation. It addresses the requirement for integrity within the analytic process by implementing immediate cryptographic signing of all analyst entries, while this is optional and configurable by the analyst.
Designed for operation in forensic-grade, air-gapped environments, the system ensures that every note, observation, and artifact is timestamped, hashed, and optionally signed via GPG (GNU Privacy Guard) upon creation. This architecture provides a verifiable, court-admissible audit trail, ensuring that the investigative timeline remains immutable and tamper-evident. Designed for operation in forensic-grade, air-gapped environments, the system ensures that every note, observation is timestamped, hashed, and optionally signed via GPG upon creation. This architecture provides a verifiable, court-admissible audit trail, ensuring that the investigative timeline remains immutable and tamper-proof.
--- ---
@@ -18,7 +18,7 @@ Designed for operation in forensic-grade, air-gapped environments, the system en
![Image](resources/gui-mockup.png) ![Image](resources/gui-mockup.png)
***Work in progress*** ***Work in progress:***
*This is a mockup how the GUI would look, drafted with Claude.* *This is a mockup how the GUI would look, drafted with Claude.*
## SYSTEM ARCHITECTURE & DESIGN PHILOSOPHY ## SYSTEM ARCHITECTURE & DESIGN PHILOSOPHY
@@ -35,7 +35,12 @@ The design of Factum-Notes prioritizes integrity, low-latency input, and deploym
The system implements a hybrid interface model: The system implements a hybrid interface model:
* **CLI (Command Line Interface):** Optimized for high-velocity data entry and rapid logging during active forensic acquisition. * **CLI (Command Line Interface):** Optimized for swift data entry and rapid logging during active forensic acquisition, while never switching from the terminal.
```bash
factum "This note is immediately saved into the currently active case. When the IP address 123.45.67.89 is contained in the note, it will also show up in the IoC Panel. We can also assign #tags for any note which enables efficient retreival"
```
* **GUI (Graphical User Interface):** A lightweight PySide6 interface for complex case management, artifact linking, and review. * **GUI (Graphical User Interface):** A lightweight PySide6 interface for complex case management, artifact linking, and review.
### Deployment Specifications ### Deployment Specifications
@@ -52,7 +57,7 @@ The system implements a hybrid interface model:
* **Hierarchical Structure:** Supports multiple unique cases, each containing distinct evidence containers. * **Hierarchical Structure:** Supports multiple unique cases, each containing distinct evidence containers.
* **Metadata Association:** optional storage of cryptographic hashes (MD5, SHA1, SHA256) for all associated evidence objects. * **Metadata Association:** optional storage of cryptographic hashes (MD5, SHA1, SHA256) for all associated evidence objects.
* **Tagging Taxonomy:** Implements a user-defined tagging system for cross-referencing findings across the dataset. * **Tagging:** Implements a user-defined tagging system for cross-referencing findings across the dataset.
### Automated Parsing ### Automated Parsing