@modular-intelligence/forensic-analysis 1.0.0 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +19 -19
- package/dist/index.js +2104 -1306
- package/package.json +12 -9
package/README.md
CHANGED
|
@@ -53,7 +53,7 @@ Calculate cryptographic hashes for file integrity verification and malware datab
|
|
|
53
53
|
**Example Output:**
|
|
54
54
|
```json
|
|
55
55
|
{
|
|
56
|
-
"file": "/
|
|
56
|
+
"file": "/path/to/sample.exe",
|
|
57
57
|
"size": 45056,
|
|
58
58
|
"md5": "d41d8cd98f00b204e9800998ecf8427e",
|
|
59
59
|
"sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
|
|
@@ -102,7 +102,7 @@ Extract ASCII and wide-character strings from binaries with automatic pattern re
|
|
|
102
102
|
**Example Output:**
|
|
103
103
|
```json
|
|
104
104
|
{
|
|
105
|
-
"file": "/
|
|
105
|
+
"file": "/path/to/sample.exe",
|
|
106
106
|
"total_strings": 1247,
|
|
107
107
|
"strings": [
|
|
108
108
|
"This program cannot be run in DOS mode",
|
|
@@ -159,7 +159,7 @@ Identify file type using magic bytes (file command) for verification of claimed
|
|
|
159
159
|
**Example Output:**
|
|
160
160
|
```json
|
|
161
161
|
{
|
|
162
|
-
"file": "/
|
|
162
|
+
"file": "/path/to/sample.exe",
|
|
163
163
|
"type": "PE32 executable (console) Intel 80386, for MS Windows",
|
|
164
164
|
"mime_type": "application/x-msdownload",
|
|
165
165
|
"magic_bytes": "4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00"
|
|
@@ -194,7 +194,7 @@ Calculate Shannon entropy to detect compression, encryption, or packing.
|
|
|
194
194
|
**Example Output:**
|
|
195
195
|
```json
|
|
196
196
|
{
|
|
197
|
-
"file": "/
|
|
197
|
+
"file": "/path/to/sample.exe",
|
|
198
198
|
"overall_entropy": 6.847,
|
|
199
199
|
"entropy_rating": "very_high (likely compressed/encrypted)",
|
|
200
200
|
"size": 45056,
|
|
@@ -241,7 +241,7 @@ Parse Windows PE (Portable Executable) headers for comprehensive binary analysis
|
|
|
241
241
|
**Example Output:**
|
|
242
242
|
```json
|
|
243
243
|
{
|
|
244
|
-
"file": "/
|
|
244
|
+
"file": "/path/to/malware.exe",
|
|
245
245
|
"is_64bit": true,
|
|
246
246
|
"machine": "AMD64",
|
|
247
247
|
"timestamp": "2023-06-15T10:23:45.000Z",
|
|
@@ -426,7 +426,7 @@ Extract metadata from image files, documents, and media using exiftool.
|
|
|
426
426
|
**Example Output:**
|
|
427
427
|
```json
|
|
428
428
|
{
|
|
429
|
-
"file": "/
|
|
429
|
+
"file": "/path/to/photo.jpg",
|
|
430
430
|
"field_count": 34,
|
|
431
431
|
"metadata": {
|
|
432
432
|
"FileName": "photo.jpg",
|
|
@@ -490,7 +490,7 @@ Recursively hash all files in a directory with duplicate file detection.
|
|
|
490
490
|
**Example Request:**
|
|
491
491
|
```json
|
|
492
492
|
{
|
|
493
|
-
"directory_path": "/
|
|
493
|
+
"directory_path": "/path/to/downloads",
|
|
494
494
|
"algorithm": "sha256",
|
|
495
495
|
"recursive": true,
|
|
496
496
|
"max_files": 1000,
|
|
@@ -501,20 +501,20 @@ Recursively hash all files in a directory with duplicate file detection.
|
|
|
501
501
|
**Example Output:**
|
|
502
502
|
```json
|
|
503
503
|
{
|
|
504
|
-
"directory": "/
|
|
504
|
+
"directory": "/path/to/downloads",
|
|
505
505
|
"algorithm": "sha256",
|
|
506
506
|
"total_files": 42,
|
|
507
507
|
"total_errors": 2,
|
|
508
508
|
"duplicates_found": 3,
|
|
509
509
|
"files": [
|
|
510
510
|
{
|
|
511
|
-
"path": "/
|
|
511
|
+
"path": "/path/to/installer.exe",
|
|
512
512
|
"hash": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f",
|
|
513
513
|
"size": 524288,
|
|
514
514
|
"modified": "2024-01-15T10:23:45.000Z"
|
|
515
515
|
},
|
|
516
516
|
{
|
|
517
|
-
"path": "/
|
|
517
|
+
"path": "/path/to/setup.exe",
|
|
518
518
|
"hash": "b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2g",
|
|
519
519
|
"size": 1048576,
|
|
520
520
|
"modified": "2024-01-14T15:30:20.000Z"
|
|
@@ -524,15 +524,15 @@ Recursively hash all files in a directory with duplicate file detection.
|
|
|
524
524
|
{
|
|
525
525
|
"hash": "c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2g3h",
|
|
526
526
|
"files": [
|
|
527
|
-
"/
|
|
528
|
-
"/
|
|
529
|
-
"/
|
|
527
|
+
"/path/to/report_v1.pdf",
|
|
528
|
+
"/path/to/report_v1_copy.pdf",
|
|
529
|
+
"/path/to/Archive/report_old.pdf"
|
|
530
530
|
]
|
|
531
531
|
}
|
|
532
532
|
],
|
|
533
533
|
"errors": [
|
|
534
534
|
{
|
|
535
|
-
"path": "/
|
|
535
|
+
"path": "/path/to/large_file.iso",
|
|
536
536
|
"error": "File too large (>100MB), skipped"
|
|
537
537
|
}
|
|
538
538
|
]
|
|
@@ -967,7 +967,7 @@ Add the server to Claude Desktop's configuration:
|
|
|
967
967
|
"command": "bun",
|
|
968
968
|
"args": [
|
|
969
969
|
"run",
|
|
970
|
-
"/
|
|
970
|
+
"/path/to/mi-mcp-servers/packages/forensic-analysis/src/index.ts"
|
|
971
971
|
]
|
|
972
972
|
}
|
|
973
973
|
}
|
|
@@ -981,7 +981,7 @@ Or with built version:
|
|
|
981
981
|
"forensic-analysis": {
|
|
982
982
|
"command": "bun",
|
|
983
983
|
"args": [
|
|
984
|
-
"/
|
|
984
|
+
"/path/to/mi-mcp-servers/packages/forensic-analysis/dist/index.js"
|
|
985
985
|
]
|
|
986
986
|
}
|
|
987
987
|
}
|
|
@@ -999,7 +999,7 @@ Add to Claude Code settings JSON:
|
|
|
999
999
|
"command": "bun",
|
|
1000
1000
|
"args": [
|
|
1001
1001
|
"run",
|
|
1002
|
-
"/
|
|
1002
|
+
"/path/to/mi-mcp-servers/packages/forensic-analysis/src/index.ts"
|
|
1003
1003
|
]
|
|
1004
1004
|
}
|
|
1005
1005
|
}
|
|
@@ -1114,7 +1114,7 @@ Claude would:
|
|
|
1114
1114
|
### Extract Metadata from Photo
|
|
1115
1115
|
|
|
1116
1116
|
```
|
|
1117
|
-
I have a photo at /
|
|
1117
|
+
I have a photo at /path/to/vacation.jpg
|
|
1118
1118
|
that I want to share publicly. What metadata does it contain?
|
|
1119
1119
|
```
|
|
1120
1120
|
|
|
@@ -1163,7 +1163,7 @@ Find all duplicate files in my Downloads directory
|
|
|
1163
1163
|
```
|
|
1164
1164
|
|
|
1165
1165
|
Claude would:
|
|
1166
|
-
1. Run `hash_directory` on `/
|
|
1166
|
+
1. Run `hash_directory` on `/path/to/downloads`
|
|
1167
1167
|
2. Report files with matching hashes
|
|
1168
1168
|
3. Identify duplicate copies and suggest deletion candidates
|
|
1169
1169
|
|