// per-tool methodology

rare process detector

drop 4688 · prefetch · or shimcache csv · rarity score 0–100 · path risk · offensive tool names · single-occurrence flag · csv export · runs locally

public grade

solid triageraw 11/14 · raw 9–11 / 14

Bstructuredsolid triage

capability class: Sstructured
subcategory: other
what to expect: useful for narrowing an investigation · expect rough edges on uncommon inputs

real parsing or rule engine · at least one structured export · honest about boundaries

binary databases and plist/registry hives — SQLite, plist, lnk, registry text, logcat

max grade for this class: A

WAL/journal sidecars and partial copies may omit recent rows
encrypted or locked stores require keys or decrypted images not supplied by this tool

meets the public B minimum ship bar: raw ≥ 9/14, UI dimension = 2, IF/OU/DQ/RB/HN ≥ 1 each, no critical red flags
expect rough edges on uncommon schema variants, oversized inputs, or partially corrupted artifacts
treat flags as leads — corroborate with primary sources before drawing conclusions
outputs require independent verification before any legal, financial, medical, safety, or evidentiary use

newly added forensics tools must clear the public B minimum before merging
minimum: letter grade B or A · raw score ≥ 9/14 · UI dimension = 2 · IF/OU/DQ/RB/HN ≥ 1 each · no critical red flags (missing engine, placeholder logic, no exports)
the ship bar is enforced by quality.audit.json sidecars and npm run tools:grade-forensics --check