How yalmn/stratum works
stratum is a read-only Windows disk-image forensics CLI. The main workflow opens a raw or EWF image, checks integrity and partitions, analyzes NTFS volumes and Windows artifacts, then writes JSON (optionally HTML). Separate branches provide targeted extraction, catalog/timeline exports, and keyword search. Analysis results retain source offsets and are normalized into a shared forensic data model. The README documents capabilities beyond the sampled implementation excerpts; those links are shown as documented flows rather than claims of inspected call sites.
Main entry points: main.rs CLI Orchestrator · context.rs Analysis Context · src Artifact Analyzers · image.rs Image Reader
Components 22
Image and Filesystem
- Image Reader
stratum_backend/core/src/image.rs - EWF Reader
stratum_backend/ewf/src/lib.rs - Integrity Hashing
stratum_backend/core/src/hash.rs - Partition Scanner
stratum_backend/core/src/partition.rs - NTFS Access
stratum_backend/ntfs/src/lib.rs - Registry Parser
stratum_backend/registry/src/hive.rs - ESE Parser
stratum_backend/ese/src/lib.rs - Shadow Copies
stratum_backend/vss/src/lib.rs
Forensic Analysis
- Analysis Context
stratum_backend/analysis/src/context.rs - Filesystem Index
stratum_backend/analysis/src/fsindex.rs - Windows Metadata
stratum_backend/analysis/src/windows.rs - Artifact Analyzers
stratum_backend/analysis/src - Account Extraction
stratum_backend/creds/src/lib.rs - Keyword Search
stratum_backend/search/src/engine.rs
Reports and Exports
- CLI Orchestrator
stratum_backend/cli/src/main.rs - JSON and HTML
stratum_backend/cli/src/report.rs - Catalog and Timelines
stratum_backend/analysis/src
Data Model
- Finding Normalizer
stratum_backend/normalize/src/lib.rs - Forensic Model
stratum_model/src/lib.rs
Other components
- Analyst
- Evidence Image
- Tor Service
Connections 21
- Analyst → CLI Orchestrator: invokes
- Evidence Image → CLI Orchestrator: provides input
- CLI Orchestrator → Image Reader: opens image
stratum_backend/cli/src/main.rs - Image Reader → EWF Reader: reads EWF
- CLI Orchestrator → Integrity Hashing: hashes image
- CLI Orchestrator → Partition Scanner: scans partitions
stratum_backend/cli/src/main.rs - CLI Orchestrator → Analysis Context: builds context
- Analysis Context → Filesystem Index: builds index
stratum_backend/analysis/src/context.rs - Analysis Context → Windows Metadata: extracts metadata
stratum_backend/analysis/src/context.rs - Analysis Context → Registry Parser: reads hives
- CLI Orchestrator → NTFS Access: analyzes volumes
- CLI Orchestrator → Artifact Analyzers: runs analysis
- Artifact Analyzers → ESE Parser: parses databases
- Artifact Analyzers → Shadow Copies: reads snapshots
- Artifact Analyzers → Account Extraction: extracts accounts
- CLI Orchestrator → Keyword Search: searches terms
- CLI Orchestrator → Finding Normalizer: normalizes findings
- Finding Normalizer → Forensic Model: maps records
stratum_backend/normalize/src/lib.rs - CLI Orchestrator → JSON and HTML: writes report
stratum_backend/cli/src/main.rs - CLI Orchestrator → Catalog and Timelines: writes exports
- CLI Orchestrator → Tor Service: checks onion