AI's forensic findings go on trial: one agent accuses, one cross-examines, one rules — and only the findings that survive are sealed into a court-ready chain of custody.
A fast agent that hallucinates produces confident, wrong findings at machine speed.
In DFIR, one hallucinated finding can get the entire investigation thrown out in court. Protocol SIFT and friends already made analysis fast — the unsolved gap is trust: distinguishing a real, defensible finding from a plausible-but-fabricated one, automatically, without a human babysitting every step. Self-review doesn't catch it; a model rarely doubts its own confident answer.
We fix hallucination the way a courtroom does — adversarially, not by asking the model to grade its own homework.
Sequences the case like a senior analyst (triage → timeline → persistence → lateral movement → exfil) and emits findings as structured objects. Every finding must cite sealed evidence.
A hostile expert witness with the same read-only tools. For each finding it re-pulls the cited evidence and must either verify it or file an evidence-backed objection — it cannot rubber-stamp or invent counter-evidence.
Issues a verdict: Sustained, Remanded (sent back, bounded), Dismissed (a caught hallucination), or Flagged for human — escalating genuine ambiguity instead of fabricating confidence.
Evidence never becomes writable; every tool call is hash-chained; the output is cryptographically signed and independently verifiable.
No execute_shell · no write/delete primitives · fixed-argv binary wrappers only · spoliation is impossible, not discouraged.
Evidence is mounted read-only; the tools layer has no write/exec primitives. Spoliation is impossible, not merely discouraged.
Every tool call is a ledger entry embedding the prior entry's hash, anchored to the evidence genesis. Tamper with any step and verification breaks at that seq.
The sealed ledger hash is Ed25519-signed and embedded in the exported PDF. A verify_case.py third party recomputes from SQLite — PASS/FAIL, pinpointing any tamper.
Sustained findings map to technique IDs (T1055 injection, T1003 credential access, T1021 lateral movement, …) and grow a live attack node-graph by forensic source.
Per-role model selection — cheap/local Investigator+Adversary, heavy Adjudicator — with live cost accounting and a projected cost-per-1,000-cases. Enterprise-SOC viable, not a billionaire's toy.
A video-editor-style scrubber replays how the attack was reconstructed over ledger time — nodes light up and edges draw in chronological order, driven by the real event timeline.
Measured against known ground truth. Combined known-error-rate 0.0% (9/9) — a reproducible control on known cases, not a stochastic field rate.
The planted Mimikatz/PsExec finding is DISMISSED; the real scheduled-task persistence is SUSTAINED across 3 sources.
We inject the fakes ourselves (seed 1337) → perfect ground truth. Every dismissal is evidence-grounded, verified from the ledger.
windows.malfind independently flagged the injection on the real Cridex memory image — RWX + MZ in explorer.exe (1484) & reader_sl.exe (1640).