# yalmn/stratum architecture

> Architecture diagram of the GitHub repository yalmn/stratum, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-01). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/yalmn/stratum
- Repository: https://github.com/yalmn/stratum

## Overview

stratum is a read-only Windows disk-image forensics CLI. The main workflow opens a raw or EWF image, checks integrity and partitions, analyzes NTFS volumes and Windows artifacts, then writes JSON (optionally HTML). Separate branches provide targeted extraction, catalog/timeline exports, and keyword search. Analysis results retain source offsets and are normalized into a shared forensic data model. The README documents capabilities beyond the sampled implementation excerpts; those links are shown as documented flows rather than claims of inspected call sites.

Main entry points: [`stratum_backend/cli/src/main.rs`](https://github.com/yalmn/stratum/blob/main/stratum_backend/cli/src/main.rs) (CLI Orchestrator), [`stratum_backend/analysis/src/context.rs`](https://github.com/yalmn/stratum/blob/main/stratum_backend/analysis/src/context.rs) (Analysis Context), [`stratum_backend/analysis/src`](https://github.com/yalmn/stratum/tree/main/stratum_backend/analysis/src) (Artifact Analyzers), [`stratum_backend/core/src/image.rs`](https://github.com/yalmn/stratum/blob/main/stratum_backend/core/src/image.rs) (Image Reader)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ingest["Image and Filesystem"]
  node_imageio["Image Reader<br/>[image.rs]"]
  node_ewf["EWF Reader<br/>[lib.rs]"]
  node_hash["Integrity Hashing<br/>[hash.rs]"]
  node_partition["Partition Scanner<br/>[partition.rs]"]
  node_ntfs["NTFS Access<br/>[lib.rs]"]
  node_registry["Registry Parser<br/>[hive.rs]"]
  node_ese["ESE Parser<br/>[lib.rs]"]
  node_vss["Shadow Copies<br/>[lib.rs]"]
end

subgraph group_analysis["Forensic Analysis"]
  node_context["Analysis Context<br/>[context.rs]"]
  node_fsindex["Filesystem Index<br/>[fsindex.rs]"]
  node_windows["Windows Metadata<br/>[windows.rs]"]
  node_artifacts["Artifact Analyzers"]
  node_creds["Account Extraction<br/>[lib.rs]"]
  node_search["Keyword Search<br/>[engine.rs]"]
end

subgraph group_outputs["Reports and Exports"]
  node_cli["CLI Orchestrator<br/>[main.rs]"]
  node_report["JSON and HTML<br/>[report.rs]"]
  node_exports["Catalog and Timelines"]
end

subgraph group_modeling["Data Model"]
  node_normalize["Finding Normalizer<br/>[lib.rs]"]
  node_model["Forensic Model<br/>[lib.rs]"]
end

node_operator(("Analyst"))
node_image["Evidence Image"]
node_tor(("Tor Service"))

node_operator -->|"invokes"| node_cli
node_image -->|"provides input"| node_cli
node_cli -->|"opens image"| node_imageio
node_imageio -.->|"reads EWF"| node_ewf
node_cli -->|"hashes image"| node_hash
node_cli -->|"scans partitions"| node_partition
node_cli -.->|"builds context"| node_context
node_context -->|"builds index"| node_fsindex
node_context -->|"extracts metadata"| node_windows
node_context -.->|"reads hives"| node_registry
node_cli -.->|"analyzes volumes"| node_ntfs
node_cli -.->|"runs analysis"| node_artifacts
node_artifacts -.->|"parses databases"| node_ese
node_artifacts -.->|"reads snapshots"| node_vss
node_artifacts -.->|"extracts accounts"| node_creds
node_cli -->|"searches terms"| node_search
node_cli -.->|"normalizes findings"| node_normalize
node_normalize -->|"maps records"| node_model
node_cli -->|"writes report"| node_report
node_cli -->|"writes exports"| node_exports
node_cli -.->|"checks onion"| node_tor

click node_cli "https://github.com/yalmn/stratum/blob/main/stratum_backend/cli/src/main.rs"
click node_imageio "https://github.com/yalmn/stratum/blob/main/stratum_backend/core/src/image.rs"
click node_ewf "https://github.com/yalmn/stratum/blob/main/stratum_backend/ewf/src/lib.rs"
click node_hash "https://github.com/yalmn/stratum/blob/main/stratum_backend/core/src/hash.rs"
click node_partition "https://github.com/yalmn/stratum/blob/main/stratum_backend/core/src/partition.rs"
click node_ntfs "https://github.com/yalmn/stratum/blob/main/stratum_backend/ntfs/src/lib.rs"
click node_registry "https://github.com/yalmn/stratum/blob/main/stratum_backend/registry/src/hive.rs"
click node_context "https://github.com/yalmn/stratum/blob/main/stratum_backend/analysis/src/context.rs"
click node_fsindex "https://github.com/yalmn/stratum/blob/main/stratum_backend/analysis/src/fsindex.rs"
click node_windows "https://github.com/yalmn/stratum/blob/main/stratum_backend/analysis/src/windows.rs"
click node_artifacts "https://github.com/yalmn/stratum/tree/main/stratum_backend/analysis/src"
click node_creds "https://github.com/yalmn/stratum/blob/main/stratum_backend/creds/src/lib.rs"
click node_ese "https://github.com/yalmn/stratum/blob/main/stratum_backend/ese/src/lib.rs"
click node_vss "https://github.com/yalmn/stratum/blob/main/stratum_backend/vss/src/lib.rs"
click node_search "https://github.com/yalmn/stratum/blob/main/stratum_backend/search/src/engine.rs"
click node_normalize "https://github.com/yalmn/stratum/blob/main/stratum_backend/normalize/src/lib.rs"
click node_model "https://github.com/yalmn/stratum/blob/main/stratum_model/src/lib.rs"
click node_report "https://github.com/yalmn/stratum/blob/main/stratum_backend/cli/src/report.rs"
click node_exports "https://github.com/yalmn/stratum/tree/main/stratum_backend/analysis/src"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_imageio,node_ewf,node_hash,node_partition,node_ntfs,node_registry,node_ese,node_vss toneBlue
class node_context,node_fsindex,node_windows,node_artifacts,node_creds,node_search toneAmber
class node_cli,node_report,node_exports toneMint
class node_normalize,node_model toneRose
class node_operator,node_image,node_tor toneIndigo
```

## Components

### Image and Filesystem

- [Image Reader](https://github.com/yalmn/stratum/blob/main/stratum_backend/core/src/image.rs): `stratum_backend/core/src/image.rs`
- [EWF Reader](https://github.com/yalmn/stratum/blob/main/stratum_backend/ewf/src/lib.rs): `stratum_backend/ewf/src/lib.rs`
- [Integrity Hashing](https://github.com/yalmn/stratum/blob/main/stratum_backend/core/src/hash.rs): `stratum_backend/core/src/hash.rs`
- [Partition Scanner](https://github.com/yalmn/stratum/blob/main/stratum_backend/core/src/partition.rs): `stratum_backend/core/src/partition.rs`
- [NTFS Access](https://github.com/yalmn/stratum/blob/main/stratum_backend/ntfs/src/lib.rs): `stratum_backend/ntfs/src/lib.rs`
- [Registry Parser](https://github.com/yalmn/stratum/blob/main/stratum_backend/registry/src/hive.rs): `stratum_backend/registry/src/hive.rs`
- [ESE Parser](https://github.com/yalmn/stratum/blob/main/stratum_backend/ese/src/lib.rs): `stratum_backend/ese/src/lib.rs`
- [Shadow Copies](https://github.com/yalmn/stratum/blob/main/stratum_backend/vss/src/lib.rs): `stratum_backend/vss/src/lib.rs`

### Forensic Analysis

- [Analysis Context](https://github.com/yalmn/stratum/blob/main/stratum_backend/analysis/src/context.rs): `stratum_backend/analysis/src/context.rs`
- [Filesystem Index](https://github.com/yalmn/stratum/blob/main/stratum_backend/analysis/src/fsindex.rs): `stratum_backend/analysis/src/fsindex.rs`
- [Windows Metadata](https://github.com/yalmn/stratum/blob/main/stratum_backend/analysis/src/windows.rs): `stratum_backend/analysis/src/windows.rs`
- [Artifact Analyzers](https://github.com/yalmn/stratum/tree/main/stratum_backend/analysis/src): `stratum_backend/analysis/src`
- [Account Extraction](https://github.com/yalmn/stratum/blob/main/stratum_backend/creds/src/lib.rs): `stratum_backend/creds/src/lib.rs`
- [Keyword Search](https://github.com/yalmn/stratum/blob/main/stratum_backend/search/src/engine.rs): `stratum_backend/search/src/engine.rs`

### Reports and Exports

- [CLI Orchestrator](https://github.com/yalmn/stratum/blob/main/stratum_backend/cli/src/main.rs): `stratum_backend/cli/src/main.rs`
- [JSON and HTML](https://github.com/yalmn/stratum/blob/main/stratum_backend/cli/src/report.rs): `stratum_backend/cli/src/report.rs`
- [Catalog and Timelines](https://github.com/yalmn/stratum/tree/main/stratum_backend/analysis/src): `stratum_backend/analysis/src`

### Data Model

- [Finding Normalizer](https://github.com/yalmn/stratum/blob/main/stratum_backend/normalize/src/lib.rs): `stratum_backend/normalize/src/lib.rs`
- [Forensic Model](https://github.com/yalmn/stratum/blob/main/stratum_model/src/lib.rs): `stratum_model/src/lib.rs`

### Other components

- **Analyst**
- **Evidence Image**
- **Tor Service**

## Connections

- Analyst → CLI Orchestrator: invokes
- Evidence Image → CLI Orchestrator: provides input
- CLI Orchestrator → Image Reader: opens image (evidence: `stratum_backend/cli/src/main.rs`)
- Image Reader → EWF Reader: reads EWF
- CLI Orchestrator → Integrity Hashing: hashes image
- CLI Orchestrator → Partition Scanner: scans partitions (evidence: `stratum_backend/cli/src/main.rs`)
- CLI Orchestrator → Analysis Context: builds context
- Analysis Context → Filesystem Index: builds index (evidence: `stratum_backend/analysis/src/context.rs`)
- Analysis Context → Windows Metadata: extracts metadata (evidence: `stratum_backend/analysis/src/context.rs`)
- Analysis Context → Registry Parser: reads hives
- CLI Orchestrator → NTFS Access: analyzes volumes
- CLI Orchestrator → Artifact Analyzers: runs analysis
- Artifact Analyzers → ESE Parser: parses databases
- Artifact Analyzers → Shadow Copies: reads snapshots
- Artifact Analyzers → Account Extraction: extracts accounts
- CLI Orchestrator → Keyword Search: searches terms
- CLI Orchestrator → Finding Normalizer: normalizes findings
- Finding Normalizer → Forensic Model: maps records (evidence: `stratum_backend/normalize/src/lib.rs`)
- CLI Orchestrator → JSON and HTML: writes report (evidence: `stratum_backend/cli/src/main.rs`)
- CLI Orchestrator → Catalog and Timelines: writes exports
- CLI Orchestrator → Tor Service: checks onion