// runnable playbook

smart home compromise

unauthorized access to camera / lock / voice-assistant. who was added, when, from where; was the cloud account reused.

a guided path, not automation — each step opens a tool you run yourself; nothing uploads. progress is saved only in this browser.

// based on the curated pipeline

wraps the smart home — access audit preset — drop Alexa / Google Home / Ring / Nest / lock / HA exports → unified timeline → report

methodology guide →worked example →full tool list + 1 more pipeline →

guided steps

0/9 done

01
evidence manifest generator
hash every smart-home export before parsing
open tool →methodology
your note (local only)
02
alexa voice history forensic extractor
Alexa voice history + smart-home command log
open tool →methodology
your note (local only)
03
google home artifact forensic analyzer
Google Home / Nest artifact parsing
open tool →methodology
your note (local only)
04
ring camera artifact forensic extractor
Ring camera access + sharing event log
open tool →methodology
your note (local only)
05
nest camera forensic analyzer
Nest camera timeline + account sharing events
open tool →methodology
your note (local only)
06
smart lock access forensic analyzer
smart lock access log — who entered and when
open tool →methodology
your note (local only)
07
home assistant forensic analyzer
Home Assistant log if the victim runs local automation
open tool →methodology
your note (local only)
08
forensic timeline builder
merge all device events into one cross-vendor timeline
suggested options · order: asc
open tool →methodology
your note (local only)
09
case report generator
draft a report identifying unauthorized access windows + added accounts
suggested options · title: smart home — access audit
open tool →methodology
your note (local only)

when you're done

export a run summary — a small JSON record of which steps you marked done, your notes, and a self-hash so the record can't be silently altered. it is your reproducibility note, not a per-tool receipt: each tool emits its own input→output receipt when you run it.