Evidence Preservation Content Archiving Report Generation Scripts

Evidence Preservation, Content Archiving & Report Generation Scripts

This section details the technical implementation of the final stages of the intelligence cycle: ensuring the forensic integrity of collected data, archiving volatile web content, grading source reliability using standardized intelligence frameworks, and generating ICD 203-compliant reports. These scripts bridge the gap between raw data collection and disseminated intelligence products.

1. Evidence Preservation Pipeline

The evidence_preservation.py script provides a forensic-grade pipeline for capturing web-based evidence. It ensures a chain of custody by hashing every artifact at the moment of capture and supporting standardized archival formats.

Key Capabilities

• Forensic Hashing: Every file (screenshots, HTML, WARC) is hashed using SHA-256 immediately upon creation.
• WARC Creation: Generates ISO 28500 compliant Web ARChive (WARC) files using warcio skills/claude-sleuth/scripts/evidence_preservation.py:10, 37-41.
• Independent Corroboration: Automatically submits URLs to the Wayback Machine (Internet Archive) via waybackpy to ensure a third-party record exists skills/claude-sleuth/scripts/evidence_preservation.py:11, 44-47, 173-189.
• Automated Screenshots: Uses Playwright to capture full-page high-resolution PNGs.

Evidence Preservation Data Flow

The EvidencePreserver class orchestrates multiple capture methods into a timestamped directory structure.

Method	Tool	Output
capture_screenshot	Playwright	screenshot.png + SHA-256
capture_html	httpx	page.html + response_headers.json
create_warc	warcio	capture.warc.gz (ISO 28500)
submit_wayback	waybackpy	Remote archive URL

• skills/claude-sleuth/scripts/evidence_preservation.py

---

2. Content Archiving & Media Capture

While the evidence preserver focuses on forensic integrity, content_archiver.py is optimized for high-volume media extraction from complex platforms (social media, video hosting, image galleries).

Implementation Details

The ContentArchiver class acts as a wrapper for specialized CLI tools:

1. yt-dlp: Handles video, metadata, subtitles, and thumbnails.
2. gallery-dl: Specialized in bulk image extraction and metadata preservation from image hosting sites.
3. Playwright: Provides a fallback for visual captures of the page.

Archive Manifest Generation

Every archive operation produces a manifest.json containing the directory structure, file sizes, and SHA-256 hashes of all downloaded content.

• skills/claude-sleuth/scripts/content_archiver.py

---

3. Admiralty 6x6 Source Grading

The source_grader.py script implements the Admiralty Scale (also known as the NATO System), which separates the reliability of a source from the credibility of the information provided.

Grading Logic

The SourceGrader.grade() function accepts two primary inputs:

• Reliability (A-F): Evaluation of the source's history and authenticity.
• Credibility (1-6): Evaluation of the specific claim's probability and consistency.

Automated Action Recommendation

The script includes a logic gate recommend_action() that calculates a combined score (0-10) to provide analytical guidance:

Combined Score	Recommendation
0-2	ACCEPT: High confidence.
3-4	ACCEPT WITH CAUTION: Seek corroboration.
5-6	CORROBORATION REQUIRED: Do not use without verification.
7-8	TREAT WITH SUSPICION: Potential disinformation.
9-10	REJECT UNLESS VERIFIED: Near-zero confidence.

Source Grading Logic Mapping

The following diagram maps the Natural Language concepts of the Admiralty Scale to the IntelligenceGrade data entity.

Admiralty Grading Entity Map

graph TD
    subgraph "Natural Language Space"
        Reliability["Source Reliability (A-F)"]
        Credibility["Information Credibility (1-6)"]
        Justification["Analytic Rationale"]
    end

    subgraph "Code Entity Space (source_grader.py)"
        IG["class IntelligenceGrade"]
        IG_Rel["reliability: str"]
        IG_Cred["credibility: str"]
        IG_Comb["combined_grade: str"]
        IG_Rec["action_recommendation: str"]
        
        SG["class SourceGrader"]
        SG_Func["grade() function"]
    end

    Reliability --> IG_Rel
    Credibility --> IG_Cred
    Justification --> IG
    SG_Func --> IG
    IG_Rel & IG_Cred --> IG_Comb
    IG_Comb --> IG_Rec

Loading

• skills/claude-sleuth/scripts/source_grader.py

---

4. Report Generation & ICD 203 Compliance

The report_generator.py script transforms analytical data into formal intelligence products. It enforces the use of the ICD 203 Probability Scale to ensure probabilistic language is standardized.

Templates & Rendering

The script uses Jinja2 to render HTML templates and WeasyPrint for PDF conversion.

1. Analytical Briefing: Includes sections for BLUF (Bottom Line Up Front), Key Facts, Assumptions, and Analytical Judgements.
2. Findings Memo: A concise document highlighting confirmed findings, unverified leads, and scope limitations.

Analytical Judgement Structure

Analytical judgements in the report are styled based on confidence levels (High, Moderate, Low), mapped to CSS classes for visual clarity in the final output skills/claude-sleuth/scripts/report_generator.py:62-65, 111.

Report Generation Data Flow

This diagram illustrates how raw investigation data is transformed into formatted intelligence products.

Reporting Pipeline Flow

graph LR
    subgraph "Data Input"
        Data["Investigation Data (JSON)"]
        ICD_Scale["ICD_203_SCALE"]
    end

    subgraph "ReportGenerator Class"
        Gen_Brief["generate_briefing()"]
        Gen_Memo["generate_memo()"]
        To_PDF["to_pdf()"]
    end

    subgraph "Templates (Jinja2)"
        BT["BRIEFING_TEMPLATE"]
        FT["FINDINGS_MEMO_TEMPLATE"]
    end

    subgraph "Output"
        HTML["HTML Report"]
        PDF["PDF Briefing (WeasyPrint)"]
    end

    Data --> Gen_Brief
    Data --> Gen_Memo
    ICD_Scale --> Gen_Brief
    
    Gen_Brief --> BT
    Gen_Memo --> FT
    
    BT --> HTML
    FT --> HTML
    HTML --> To_PDF
    To_PDF --> PDF

Loading

• skills/claude-sleuth/scripts/report_generator.py

---