// runnable playbook

trade secret / IP theft

exiting employee took the source/customer list/CAD. preserve USB attach times, cloud-sync, print, and email-out evidence.

a guided path, not automation — each step opens a tool you run yourself; nothing uploads. progress is saved only in this browser.

// based on the curated pipeline

wraps the trade secret — exfil kit preset — drop LNK / jumplist / shellbag / print spool / download history / git exports → timeline → report

methodology guide →worked example →full tool list + 1 more pipeline →

guided steps

0/8 done

01
evidence manifest generator
hash every artifact before timeline reconstruction
open tool →methodology
your note (local only)
02
lnk file batch timeline correlator
batch-correlate LNK shortcuts into a file-access timeline
open tool →methodology
your note (local only)
03
jump list cross-application timeline correlator
deep jumplist analysis for recently accessed files
open tool →methodology
your note (local only)
04
shellbag timeline extended
shellbag folder-access timeline for USB / network paths
open tool →methodology
your note (local only)
05
print spooler artifact forensic analyzer
print spool artifacts — exfil via printed documents
open tool →methodology
your note (local only)
06
browser download history correlator
correlate browser downloads with file-access artifacts
open tool →methodology
your note (local only)
07
git repository forensic analyzer
git history analysis if source code exfil is suspected
open tool →methodology
your note (local only)
08
case report generator
draft a report linking artifact timelines to the exfil hypothesis
suggested options · title: trade secret — exfil assessment
open tool →methodology
your note (local only)

when you're done

export a run summary — a small JSON record of which steps you marked done, your notes, and a self-hash so the record can't be silently altered. it is your reproducibility note, not a per-tool receipt: each tool emits its own input→output receipt when you run it.