LLM-DFIR — AI Forensics Toolkit

Artifacts

0

Import to begin

IOCs Detected

0

No findings

Critical

0

API keys / private keys

Timeline Events

0

Sorted by mtime

▣ Quick Start

Run the triage script on a target host, then drag the output files into the Import tab to review them here.

$ git clone https://github.com/SiteQ8/LLM-DFIR.git $ cd LLM-DFIR $ python3 scripts/llm_triage.py --output ./evidence

⏱ Recent Activity

⏱

No activity yet

📂 Case Summary

Case Name: —
Created: —
Last Modified: —
Imported Files: 0
Categories: —

ⓘDrop the output files from scripts/llm_triage.py here. JSON files (timeline.json, iocs.json) and the CSV inventory are supported. Files are processed entirely in your browser.

↥ Import Triage Output

Drop or click to upload

📁

Drop triage files here

timeline.json · iocs.json · evidence_inventory.csv

📋 Imported Files

📂

No files imported yet

Category

Sort

Tool	Category	Path	Size	Modified

Severity All Critical High Info

Type All API Keys Injection Exfil Endpoints

⏱ Forensic Timeline

No events

⚙ Triage Command Builder

Configure and generate a ready-to-run triage command for the target host.

Target OS

Output Directory

Collection Options

Content scan for IOCs SHA-256 hashing HTML report

Generated Command

⚠Run on the target host with the privileges of the user being investigated.

📦 Companion Commands

Snapshot MCP config + sessions

$ cp ~/Library/Application\ Support/Claude/claude_desktop_config.json /Volumes/EVIDENCE/ $ cp -r ~/.claude/sessions/ /Volumes/EVIDENCE/sessions/

Enumerate MCP tool calls

$ grep -h '"method":"tools/call"' ~/Library/Logs/Claude/mcp-server-*.log | jq -r '.params.name' | sort | uniq -c

Query Cursor workspace state

$ sqlite3 ~/Library/Application\ Support/Cursor/User/workspaceStorage/*/state.vscdb "SELECT key,substr(value,1,200) FROM ItemTable WHERE key LIKE '%composer%';"

Dump ChromaDB indexed documents

$ sqlite3 ~/.chroma/chroma.sqlite3 "SELECT collection_id,substr(document,1,500) FROM embeddings_queue LIMIT 50;"

🔎 Artifact Path Lookup

Paste a file path you found during analysis. The tool identifies which AI artifact category it belongs to.

File path

⚗ IOC Pattern Scanner

Paste content from a suspicious file. The scanner runs the same patterns as the triage script.

Content to scan

Detection Patterns

API Keys: sk-* · sk-ant-* · AIza* · pcsk_* · hf_*
Endpoints: openai · anthropic · azure · google
Injection: ignore previous · ChatML · jailbreak
Exfil: private keys · SSN · CC · keywords

ⓘMinimum logging controls every organization should enable.