// industry vertical
backup / disaster recovery forensics
Veeam · Rubrik · Commvault · Acronis · Datto BCDR · AWS Backup · Azure RSV · backup deletion anomalies · ransomware target tampering · multi-vendor backup timeline correlation.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this vertical.
- veeam backup job session forensic analyzerdrop veeam backup session export · parse job + vm + result + warning · runs locally
- rubrik backup snapshot audit forensic analyzerdrop rubrik event export · parse sla domain + snapshot + legal hold · runs locally
- backup deletion anomaly detectordrop backup audit log export · detect mass delete + off-hours purge · runs locally
- ransomware backup target tampering detectordrop backup repository audit export · detect encryption/delete on backup targets · runs locally
- case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
also useful · secondary tools
cross-cutting tools that surface depending on the specific investigation.
- commvault backup job log forensic analyzerdrop commvault job history export · parse subclient + media + failure code · runs locally
- acronis backup task export forensic analyzerdrop acronis backup task export · parse plan + agent + result status · runs locally
- datto bcdr restore point forensic analyzerdrop datto bcdr snapshot export · parse device + restore point + verification · runs locally
- aws backup recovery point forensic analyzerdrop aws backup recovery point export · parse vault + resource + lifecycle · runs locally
- azure recovery services vault backup forensic analyzerdrop azure rsv backup item export · parse policy + last backup + health · runs locally
- multi vendor backup timeline correlatordrop 2+ backup vendor exports · unified job timeline graph · runs locally
- evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
want deeper backup / DR coverage?
this vertical is intentionally sparse — deep-moat coverage grows over time. tracked in the forensics rollout.