disgruntled employee exit
last-day endpoint snapshot: deletions, USB attach, cloud sync bursts, sabotage indicators (scheduled tasks, hidden accounts).
a guided path, not automation — each step opens a tool you run yourself; nothing uploads. progress is saved only in this browser.
wraps the disgruntled exit — sabotage kit preset — drop endpoint snapshot → shredder remnants → deletion bursts → history clearing → meta-deletion → report
guided steps
- evidence manifest generator
hash the last-day endpoint snapshot before analysis
- file shredder remnant and signature scanner
detect secure-deletion / shredder tool remnants
- registry key deletion burst detector
registry key deletion bursts — common sabotage pattern
- scheduled task deletion and history clearing detector
scheduled task deletion — persistence cleanup or sabotage
- PowerShell history clearing detector
PowerShell history clearing on the last day
- evidence of evidence deletion detector
meta-forensics: detect evidence-of-evidence deletion itself
- case report generator
draft a report documenting anti-forensics + sabotage indicators
suggested options · title: disgruntled exit — sabotage assessment
when you're done
export a run summary — a small JSON record of which steps you marked done, your notes, and a self-hash so the record can't be silently altered. it is your reproducibility note, not a per-tool receipt: each tool emits its own input→output receipt when you run it.