Ask Guddi AI
COPILOT
Sovereign Intel • Ctrl+/
The world's first 100% pure-Rust DFIR tactical workstation. Built for high-assurance enclaves, SOC teams, and field responders: non-destructive atomic memory acquisition, live LOLBAS process hunting, EVTX Sigma evaluation, and Merkle-sealed evidence dossiers.
Engineered from the silicon up to guarantee non-destructive evidence capture, memory safety, and complete operational sovereignty.
Traditional EDR and forensic agents rely on fragile kernel-mode drivers (.sys), creating catastrophic BSOD vectors. AlaskaForensics executes strictly in user-space (Ring 3) utilizing direct Win32 and Linux native system calls, guaranteeing zero host crash risk.
For incident responders walking up to suspect machines in secure SCIFs or disconnected enclaves. Runs as a standalone static binary directly from a flash drive. All memory dumps, hashes, and audit logs are strictly written to the USB's ./evidence_vault/ without writing a single byte to the target drive.
Operates natively across Windows (10/11/Server 2022) and Linux (Ubuntu, Debian, RHEL). Runs as an interactive desktop workstation or as a headless background daemon (--headless) serving an embedded Axum 0.7 Tactical Web HUD on port 5175, supervised by Windows SCM and Linux systemd.
Every evidence artifact, process snapshot, memory minidump, and analyst action is hashed with SHA-256 and BLAKE3, then committed to a cryptographic Merkle tree. Once sealed (is_sealed: true), case dossiers become permanently tamper-evident and court-admissible.
AlaskaForensics unites the specialized capabilities of Alaska's pure-Rust defense engines into a unified tactical pane of glass.
Real-time PID/PPID process tree scanning, parent-child spoofing heuristics, and Shannon entropy (H ≥ 4.5) calculation for encrypted PowerShell blobs and LOLBAS binaries.
Pure-Rust in-memory YAML Sigma evaluator directly scanning Windows Security, System, and Sysmon event logs (4688, 4624, 7045) with sub-second alert classification.
User-mode minidump generation (MiniDumpWithFullMemory) with immediate SHA-256 digest sealing and compressed streaming to portable storage.
Parses NTFS $MFT, Shimcache, Amcache, Shellbags, and browser SQLite history into a millisecond-precision chronological super-timeline without mutating file system timestamps.
Evaluates 256 single-byte XOR keys with ASCII frequency scoring, decodes Base64, nested PowerShell -enc, and automatically defangs malicious IOCs for safe incident reports.
1-Click emergency host network isolation via Windows Filtering Platform (WFP) and Linux nftables with whitelisted relay survival and non-destructive process freezing.
From an analyst workstation to an air-gapped jump box or a live USB triage stick.
Tauri 2.0 native application window with zero console flash, Edge WebView2 integration, and Arctic Glacier Light / Cyberpunk Dark themes.
alaskaforensics.exe
Lightweight background service for enterprise servers and cloud bastions. Embedded Axum 0.7 web server exposes the Tactical HUD.
alaskaforensics --headless --port 5175
Completely self-contained portable package on a FAT32/exFAT drive. All artifacts and minidumps save to USB without host contamination.
E:\launch_fieldkit.bat
100% perpetual sovereign node licenses synced live with myAlaskaDB.pricing_tiers. Zero mandatory subscriptions. Zero cloud reliance.
20-Crate Forensic OS & Acquisition Workstation for disk/RAM imaging, BitLocker/LUKS2 decryption, and court reports.
5 Forensic Lab Workstations with parallel GPU hash cracking, drone/vehicle telemetry, and multi-examiner chain-of-custody.
Complete 4-Flagship Enclave: 5 AlaskaCommand + 5 AlaskaForensics + 5 AlaskaSentinel + 5 AlaskaVault (20 Nodes) + All 17 Tactical Crates.
Request a vetted 30-day evaluation pilot or perpetual offline license key below. Zero external cloud dependencies, zero telemetry tracking.