# emadabedini/dumplyzer architecture

> Architecture diagram of the GitHub repository emadabedini/dumplyzer, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/emadabedini/dumplyzer
- Repository: https://github.com/emadabedini/dumplyzer

## Overview

Dumplyzer is a local-first desktop memory-forensics workbench. An analyst imports a memory image, selects guided or custom analysis, and explores persisted process, network, memory, finding, IOC, and timeline results before optionally running heavier extraction or signature tasks and exporting reports. The graph follows the documented frontend-to-local-engine design and the sampled server, job, coverage, and Volatility code; several analysis and bridge links reflect documented responsibilities rather than inspected call sites.

Main entry points: [`engine/memscope_engine/storage/schema.py`](https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/storage/schema.py) (Artifact database), [`engine/memscope_engine/analysis/workflows.py`](https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/analysis/workflows.py) (Analysis workflows), [`app/frontend/src/App.tsx`](https://github.com/emadabedini/dumplyzer/blob/main/app/frontend/src/App.tsx) (Investigation UI), [`app/frontend/src/lib/api.ts`](https://github.com/emadabedini/dumplyzer/blob/main/app/frontend/src/lib/api.ts) (Engine client)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_desktop["Desktop workspace"]
  node_workspace["Investigation UI<br/>[App.tsx]"]
  node_views["Workspace views"]
  node_api["Engine client<br/>[api.ts]"]
  node_bridge["Desktop bridge<br/>[lib.rs]"]
end

subgraph group_engine["Engine orchestration"]
  node_engine_spawn["Engine launcher<br/>[engine.rs]"]
  node_rpc["RPC server<br/>[server.py]"]
  node_jobs["Job manager<br/>[manager.py]"]
end

subgraph group_analysis["Evidence analysis"]
  node_workflow["Analysis workflows<br/>[workflows.py]"]
  node_process["Process analysis"]
  node_network["Network artifacts"]
  node_plugin["Plugin explorer<br/>[plugin_explorer.py]"]
  node_specialized["Specialized analyses"]
end

subgraph group_results["Investigation results"]
  node_database[("Artifact database<br/>[schema.py]")]
  node_coverage["Coverage derivation<br/>[coverage.py]"]
  node_search_iocs["Search and IOCs<br/>[search_iocs.py]"]
  node_artifacts["Artifact store<br/>[store.py]"]
  node_exports["Report exports<br/>[workflows.py]"]
end

subgraph group_integrations["Analysis integrations"]
  node_volatility["Volatility session<br/>[session.py]"]
  node_tools["Local analysis tools"]
end

node_analyst(("Analyst"))
node_image["Memory image"]

node_analyst -->|"uses"| node_workspace
node_image -->|"selects"| node_workspace
node_workspace -->|"renders"| node_views
node_workspace -->|"requests"| node_api
node_api -->|"invokes"| node_bridge
node_bridge -->|"starts"| node_engine_spawn
node_engine_spawn -->|"runs"| node_rpc
node_rpc -->|"queues work"| node_jobs
node_rpc -->|"dispatches"| node_workflow
node_workflow -->|"runs plugins"| node_volatility
node_plugin -->|"runs plugins"| node_volatility
node_volatility -->|"reads"| node_image
node_workflow -->|"calls"| node_process
node_workflow -->|"calls"| node_network
node_jobs -->|"dispatches"| node_specialized
node_specialized -.->|"uses"| node_tools
node_workflow -->|"persists"| node_database
node_process -->|"persists"| node_database
node_network -->|"persists"| node_database
node_specialized -->|"records"| node_artifacts
node_coverage -->|"reads runs"| node_database
node_search_iocs -->|"searches"| node_database
node_exports -->|"collects results"| node_database
node_api -->|"returns results"| node_views

click node_workspace "https://github.com/emadabedini/dumplyzer/blob/main/app/frontend/src/App.tsx"
click node_views "https://github.com/emadabedini/dumplyzer/tree/main/app/frontend/src/components"
click node_api "https://github.com/emadabedini/dumplyzer/blob/main/app/frontend/src/lib/api.ts"
click node_bridge "https://github.com/emadabedini/dumplyzer/blob/main/app/desktop/src/lib.rs"
click node_engine_spawn "https://github.com/emadabedini/dumplyzer/blob/main/app/desktop/src/engine.rs"
click node_rpc "https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/server.py"
click node_jobs "https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/jobs/manager.py"
click node_workflow "https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/analysis/workflows.py"
click node_process "https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/analysis/process_analysis.py"
click node_network "https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/analysis/network_artifacts.py"
click node_plugin "https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/analysis/plugin_explorer.py"
click node_specialized "https://github.com/emadabedini/dumplyzer/tree/main/engine/memscope_engine/analysis"
click node_volatility "https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/volatility/session.py"
click node_tools "https://github.com/emadabedini/dumplyzer/tree/main/engine/memscope_engine/providers"
click node_database "https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/storage/schema.py"
click node_coverage "https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/analysis/coverage.py"
click node_search_iocs "https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/analysis/search_iocs.py"
click node_artifacts "https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/artifacts/store.py"
click node_exports "https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/export/workflows.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_workspace,node_views,node_api,node_bridge toneBlue
class node_engine_spawn,node_rpc,node_jobs toneAmber
class node_workflow,node_process,node_network,node_plugin,node_specialized toneMint
class node_database,node_coverage,node_search_iocs,node_artifacts,node_exports toneRose
class node_volatility,node_tools,node_analyst,node_image toneIndigo
```

## Components

### Desktop workspace

- [Investigation UI](https://github.com/emadabedini/dumplyzer/blob/main/app/frontend/src/App.tsx): `app/frontend/src/App.tsx`
- [Workspace views](https://github.com/emadabedini/dumplyzer/tree/main/app/frontend/src/components): `app/frontend/src/components`
- [Engine client](https://github.com/emadabedini/dumplyzer/blob/main/app/frontend/src/lib/api.ts): `app/frontend/src/lib/api.ts`
- [Desktop bridge](https://github.com/emadabedini/dumplyzer/blob/main/app/desktop/src/lib.rs): `app/desktop/src/lib.rs`

### Engine orchestration

- [Engine launcher](https://github.com/emadabedini/dumplyzer/blob/main/app/desktop/src/engine.rs): `app/desktop/src/engine.rs`
- [RPC server](https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/server.py): `engine/memscope_engine/server.py`
- [Job manager](https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/jobs/manager.py): `engine/memscope_engine/jobs/manager.py`

### Evidence analysis

- [Analysis workflows](https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/analysis/workflows.py): `engine/memscope_engine/analysis/workflows.py`
- [Process analysis](https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/analysis/process_analysis.py): `engine/memscope_engine/analysis/process_analysis.py`
- [Network artifacts](https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/analysis/network_artifacts.py): `engine/memscope_engine/analysis/network_artifacts.py`
- [Plugin explorer](https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/analysis/plugin_explorer.py): `engine/memscope_engine/analysis/plugin_explorer.py`
- [Specialized analyses](https://github.com/emadabedini/dumplyzer/tree/main/engine/memscope_engine/analysis): `engine/memscope_engine/analysis`

### Investigation results

- [Artifact database](https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/storage/schema.py): `engine/memscope_engine/storage/schema.py`
- [Coverage derivation](https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/analysis/coverage.py): `engine/memscope_engine/analysis/coverage.py`
- [Search and IOCs](https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/analysis/search_iocs.py): `engine/memscope_engine/analysis/search_iocs.py`
- [Artifact store](https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/artifacts/store.py): `engine/memscope_engine/artifacts/store.py`
- [Report exports](https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/export/workflows.py): `engine/memscope_engine/export/workflows.py`

### Analysis integrations

- [Volatility session](https://github.com/emadabedini/dumplyzer/blob/main/engine/memscope_engine/volatility/session.py): `engine/memscope_engine/volatility/session.py`
- [Local analysis tools](https://github.com/emadabedini/dumplyzer/tree/main/engine/memscope_engine/providers): `engine/memscope_engine/providers`

### Other components

- **Analyst**
- **Memory image**

## Connections

- Analyst → Investigation UI: uses
- Memory image → Investigation UI: selects
- Investigation UI → Workspace views: renders
- Investigation UI → Engine client: requests
- Engine client → Desktop bridge: invokes
- Desktop bridge → Engine launcher: starts
- Engine launcher → RPC server: runs
- RPC server → Job manager: queues work
- RPC server → Analysis workflows: dispatches
- Analysis workflows → Volatility session: runs plugins
- Plugin explorer → Volatility session: runs plugins
- Volatility session → Memory image: reads
- Analysis workflows → Process analysis: calls
- Analysis workflows → Network artifacts: calls
- Job manager → Specialized analyses: dispatches
- Specialized analyses → Local analysis tools: uses
- Analysis workflows → Artifact database: persists
- Process analysis → Artifact database: persists
- Network artifacts → Artifact database: persists
- Specialized analyses → Artifact store: records
- Coverage derivation → Artifact database: reads runs
- Search and IOCs → Artifact database: searches
- Report exports → Artifact database: collects results
- Engine client → Workspace views: returns results