# keyuraghao/edb_file_explorer architecture

> Architecture diagram of the GitHub repository keyuraghao/edb_file_explorer, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/keyuraghao/edb_file_explorer
- Repository: https://github.com/keyuraghao/edb_file_explorer

## Overview

EDB Explorer is a read-only forensic database analysis product with desktop, command-line, and MCP entry points. Analysts open evidence files, inspect normalized tables and application-aware artifacts, run cross-database analysis, and extract or package results. The graph reflects documented capabilities and sampled entry-point, session, database, SQL, GUI-task, and Exchange code; some subsystem connections are documented in the README rather than verified in sampled source.

Main entry points: [`src/edb_explorer/gui/app.py`](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/gui/app.py) (Desktop GUI), [`src/edb_explorer/cli.py`](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/cli.py) (CLI), [`src/edb_explorer/mcp/server.py`](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/mcp/server.py) (MCP server), [`src/edb_explorer/core/session.py`](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/session.py) (Open sessions)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interfaces["User interfaces"]
  node_gui["Desktop GUI<br/>[app.py]"]
  node_cli["CLI<br/>[cli.py]"]
  node_mcp["MCP server<br/>[server.py]"]
end

subgraph group_ingest["Evidence access"]
  node_session["Open sessions<br/>[session.py]"]
  node_backends["Format backends"]
  node_database["Read-only database<br/>[database.py]"]
  node_profiles["Artifact profiles<br/>[profiles.py]"]
  node_rowstore[("Large-table cache<br/>[rowstore.py]")]
end

subgraph group_analysis["Analysis"]
  node_sql["SQL workspace<br/>[sqlworkspace.py]"]
  node_timeline["Timeline analysis<br/>[analysis.py]"]
  node_search["Database search<br/>[search.py]"]
  node_stats["Column statistics<br/>[analysis.py]"]
end

subgraph group_outputs["Exchange and outputs"]
  node_exchange["Mailbox viewer<br/>[store.py]"]
  node_export["Data extraction<br/>[export.py]"]
  node_report["Analyst reports<br/>[report.py]"]
  node_project["Case projects<br/>[project.py]"]
end

node_analyst(("Analyst"))
node_agent(("AI agent"))

node_analyst -->|"uses"| node_gui
node_analyst -->|"uses"| node_cli
node_agent -->|"requests analysis"| node_mcp
node_gui -->|"opens evidence"| node_session
node_cli -->|"opens evidence"| node_session
node_mcp -->|"opens evidence"| node_session
node_session -->|"detects formats"| node_backends
node_session -->|"creates sessions"| node_database
node_database -->|"reads records"| node_backends
node_database -->|"applies artifact hints"| node_profiles
node_gui -->|"caches large tables"| node_rowstore
node_gui -->|"runs queries"| node_sql
node_cli -->|"runs queries"| node_sql
node_mcp -->|"runs queries"| node_sql
node_sql -->|"materializes tables"| node_database
node_gui -->|"builds timelines"| node_timeline
node_mcp -->|"builds timelines"| node_timeline
node_cli -->|"builds timelines"| node_timeline
node_gui -->|"searches evidence"| node_search
node_mcp -->|"searches evidence"| node_search
node_gui -->|"computes statistics"| node_stats
node_cli -->|"computes statistics"| node_stats
node_gui -->|"views mailboxes"| node_exchange
node_cli -->|"queries mailboxes"| node_exchange
node_gui -->|"extracts data"| node_export
node_cli -->|"extracts data"| node_export
node_gui -->|"generates reports"| node_report
node_cli -->|"generates reports"| node_report
node_mcp -->|"generates reports"| node_report
node_gui -->|"manages handover"| node_project
node_cli -->|"manages handover"| node_project

click node_gui "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/gui/app.py"
click node_cli "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/cli.py"
click node_mcp "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/mcp/server.py"
click node_session "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/session.py"
click node_backends "https://github.com/keyuraghao/edb_file_explorer/tree/main/src/edb_explorer/core/backends"
click node_database "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/database.py"
click node_profiles "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/profiles.py"
click node_rowstore "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/rowstore.py"
click node_sql "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/sqlworkspace.py"
click node_timeline "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/analysis.py"
click node_search "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/search.py"
click node_stats "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/analysis.py"
click node_exchange "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/exchange/store.py"
click node_export "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/export.py"
click node_report "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/report.py"
click node_project "https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/project.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_gui,node_cli,node_mcp toneBlue
class node_session,node_backends,node_database,node_profiles,node_rowstore toneAmber
class node_sql,node_timeline,node_search,node_stats toneMint
class node_exchange,node_export,node_report,node_project toneRose
class node_analyst,node_agent toneIndigo
```

## Components

### User interfaces

- [Desktop GUI](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/gui/app.py): `src/edb_explorer/gui/app.py`
- [CLI](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/cli.py): `src/edb_explorer/cli.py`
- [MCP server](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/mcp/server.py): `src/edb_explorer/mcp/server.py`

### Evidence access

- [Open sessions](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/session.py): `src/edb_explorer/core/session.py`
- [Format backends](https://github.com/keyuraghao/edb_file_explorer/tree/main/src/edb_explorer/core/backends): `src/edb_explorer/core/backends`
- [Read-only database](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/database.py): `src/edb_explorer/core/database.py`
- [Artifact profiles](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/profiles.py): `src/edb_explorer/core/profiles.py`
- [Large-table cache](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/rowstore.py): `src/edb_explorer/core/rowstore.py`

### Analysis

- [SQL workspace](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/sqlworkspace.py): `src/edb_explorer/core/sqlworkspace.py`
- [Timeline analysis](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/analysis.py): `src/edb_explorer/core/analysis.py`
- [Database search](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/search.py): `src/edb_explorer/core/search.py`
- [Column statistics](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/analysis.py): `src/edb_explorer/core/analysis.py`

### Exchange and outputs

- [Mailbox viewer](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/exchange/store.py): `src/edb_explorer/core/exchange/store.py`
- [Data extraction](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/export.py): `src/edb_explorer/core/export.py`
- [Analyst reports](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/report.py): `src/edb_explorer/core/report.py`
- [Case projects](https://github.com/keyuraghao/edb_file_explorer/blob/main/src/edb_explorer/core/project.py): `src/edb_explorer/core/project.py`

### Other components

- **Analyst**
- **AI agent**

## Connections

- Analyst → Desktop GUI: uses
- Analyst → CLI: uses
- AI agent → MCP server: requests analysis
- Desktop GUI → Open sessions: opens evidence
- CLI → Open sessions: opens evidence
- MCP server → Open sessions: opens evidence
- Open sessions → Format backends: detects formats
- Open sessions → Read-only database: creates sessions
- Read-only database → Format backends: reads records
- Read-only database → Artifact profiles: applies artifact hints
- Desktop GUI → Large-table cache: caches large tables
- Desktop GUI → SQL workspace: runs queries
- CLI → SQL workspace: runs queries
- MCP server → SQL workspace: runs queries
- SQL workspace → Read-only database: materializes tables
- Desktop GUI → Timeline analysis: builds timelines
- MCP server → Timeline analysis: builds timelines
- CLI → Timeline analysis: builds timelines
- Desktop GUI → Database search: searches evidence
- MCP server → Database search: searches evidence
- Desktop GUI → Column statistics: computes statistics
- CLI → Column statistics: computes statistics
- Desktop GUI → Mailbox viewer: views mailboxes
- CLI → Mailbox viewer: queries mailboxes
- Desktop GUI → Data extraction: extracts data
- CLI → Data extraction: extracts data
- Desktop GUI → Analyst reports: generates reports
- CLI → Analyst reports: generates reports
- MCP server → Analyst reports: generates reports
- Desktop GUI → Case projects: manages handover
- CLI → Case projects: manages handover