First public release.
- Triage of a live volume, a machine from WinRE, or a disk image (
dd, VDI, VMDK snapshot chains), reading NTFS and the registry hives in-process. - Parsers for
$MFT, the USN journal, Amcache, ShimCache, prefetch, PCA, UserAssist, scheduled tasks, run keys, Startup shortcuts, Defender's log and quarantine, the recycle bin, mark-of-the-web, and PE structure with pefile-compatible imphash and Rich header. - Evidence scoring as log-likelihood ratios over a per-machine prior, with
explainfor the reasoning behind every weight. - Sample recovery from the live file, quarantine, recycle bin, shadow copies, deleted
$MFTclusters, index slack, orphaned records, the unused tail of a reused$MFTrecord, and record images still in$LogFile, each labelled by how it was verified;--deepcarves free space by recorded digest, or by the name an image carries inside itself when nothing ever hashed it. - Offline Authenticode and catalog verification against pinned roots.
- Report redaction for sharing:
--redactandmalmathic redact. - The case directory defaults to
cases\<volume>-<time>on the drive holding the exe; a double-click launch shows it and waits for Enter or another path. - Python bindings
pymalmathic. - Tests that pin the no-execution, no-mounting and no-network properties, the read-only image readers, and the audited dependency list.
Full Changelog: https://github.com/milk-analyzer/malmathic/commits/v0.1.0