How keyuraghao/edb_file_explorer works
EDB Explorer is a read-only forensic database analysis product with desktop, command-line, and MCP entry points. Analysts open evidence files, inspect normalized tables and application-aware artifacts, run cross-database analysis, and extract or package results. The graph reflects documented capabilities and sampled entry-point, session, database, SQL, GUI-task, and Exchange code; some subsystem connections are documented in the README rather than verified in sampled source.
Main entry points: app.py Desktop GUI · cli.py CLI · server.py MCP server · session.py Open sessions
Components 18
User interfaces
- Desktop GUI
src/edb_explorer/gui/app.py - CLI
src/edb_explorer/cli.py - MCP server
src/edb_explorer/mcp/server.py
Evidence access
- Open sessions
src/edb_explorer/core/session.py - Format backends
src/edb_explorer/core/backends - Read-only database
src/edb_explorer/core/database.py - Artifact profiles
src/edb_explorer/core/profiles.py - Large-table cache
src/edb_explorer/core/rowstore.py
Analysis
- SQL workspace
src/edb_explorer/core/sqlworkspace.py - Timeline analysis
src/edb_explorer/core/analysis.py - Database search
src/edb_explorer/core/search.py - Column statistics
src/edb_explorer/core/analysis.py
Exchange and outputs
- Mailbox viewer
src/edb_explorer/core/exchange/store.py - Data extraction
src/edb_explorer/core/export.py - Analyst reports
src/edb_explorer/core/report.py - Case projects
src/edb_explorer/core/project.py
Other components
- Analyst
- AI agent
Connections 31
- Analyst → Desktop GUI: uses
- Analyst → CLI: uses
- AI agent → MCP server: requests analysis
- Desktop GUI → Open sessions: opens evidence
- CLI → Open sessions: opens evidence
- MCP server → Open sessions: opens evidence
- Open sessions → Format backends: detects formats
- Open sessions → Read-only database: creates sessions
- Read-only database → Format backends: reads records
- Read-only database → Artifact profiles: applies artifact hints
- Desktop GUI → Large-table cache: caches large tables
- Desktop GUI → SQL workspace: runs queries
- CLI → SQL workspace: runs queries
- MCP server → SQL workspace: runs queries
- SQL workspace → Read-only database: materializes tables
- Desktop GUI → Timeline analysis: builds timelines
- MCP server → Timeline analysis: builds timelines
- CLI → Timeline analysis: builds timelines
- Desktop GUI → Database search: searches evidence
- MCP server → Database search: searches evidence
- Desktop GUI → Column statistics: computes statistics
- CLI → Column statistics: computes statistics
- Desktop GUI → Mailbox viewer: views mailboxes
- CLI → Mailbox viewer: queries mailboxes
- Desktop GUI → Data extraction: extracts data
- CLI → Data extraction: extracts data
- Desktop GUI → Analyst reports: generates reports
- CLI → Analyst reports: generates reports
- MCP server → Analyst reports: generates reports
- Desktop GUI → Case projects: manages handover
- CLI → Case projects: manages handover