starshield-forensics (v0.3.7 — Clean-Room Deterministic DFIR Toolkit)

Deterministic Chromium IndexedDB / LevelDB .log Multi-Schema Record Carver, Zero-PII Precheck Gate, Structural Image Container Inspector & Financial Checksum Validator

Author: Ziqi Xiao (@Ziqi) · Concept DOI: 10.5281/zenodo.24145804 · OpenSSF Best Practices: #16602 · License: MIT · Runtime: Python >= 3.10 (stdlib only, zero network calls, zero LLM dependencies)

Scope & Operational Notice

starshield-forensics is an offline, read-only digital forensics and pre-action evidence triage library for inspecting local Chromium storage write-ahead logs (.log), running zero-PII intake feasibility checks (starshield precheck), triaging exported web-messaging / B2B portal JSON caches, inspecting PNG/JPEG ICC metadata structures, and validating multi-jurisdiction payment identifiers (ISO/IEC 7812 Luhn, ISO 13616 IBAN Mod-97, ISO 9362 SWIFT/BIC, and intra-message UK Sort Code pairs).

All bundled fixtures in samples/ and starshield/data/—plus the seeded 24-case evaluation suite in benchmark/benchmark_suite.py (StarShield-Bench-24)—are 100% clean-room specification test vectors modeled on a fictional 2025 UK supplier-invoice scenario (GBP 18,400.00, ISO-13616 example IBANs GB82WEST12345698765432 and NO9386011117947, Luhn test string 6200000000000005). Zero real incident data or PII is included.

Epistemic Tiers & Capability Boundary Matrix (v0.3.6)

Every analytical output carries an explicit machine-readable epistemic tier so investigators and solicitors never conflate raw bytes with interpretive leads:

• OBSERVED: Directly present in raw input bytes, chunk headers, or JSON fields (bound to physical WAL frame offsets or chunk offsets).
• DERIVED: Deterministically computed from raw input via standardized algorithms (Castagnoli CRC32C, ISO/IEC 7812 Luhn, ISO-13616 Mod-97, UTC delta arithmetic).
• INFERRED: Contextual triage lead requiring external corroboration (e.g., server-side bank logs or subpoenaed ISP records); never asserted as standalone proof.
• UNKNOWN: Explicitly outside the evidentiary boundary of local client artifacts (e.g., records compacted prior to acquisition).

Installation, Zero-Install .pyz & StarShield-Bench-24 Quickstart

# Option A — Zero-install single-file zipapp (for air-gapped forensic VMs & law-firm IT):
python3 starshield.pyz demo
python3 starshield.pyz precheck /path/to/readonly_chromium_idb_copy

# Option B — Clone & run all 24 unit tests + StarShield-Bench-24 (<0.2s, zero dependencies):
git clone https://github.com/Ziqi/starshield-forensics.git
cd starshield-forensics
PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=. python3 -m unittest discover -s tests -v
PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=. python3 benchmark/benchmark_suite.py
PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=. python3 -m starshield.cli demo

CLI Subcommands (starshield [--unredacted] [--max-mb 64] <subcommand>)

Deterministic Core vs. Human-Reviewed Triage

starshield-forensics intentionally contains zero LLM or network code. Byte-offset extraction, CRC32C verification, and banking check-digit math must be 100% deterministic and reproducible, ensuring embedded adversary messages cannot trigger indirect prompt injection during extraction. Any downstream bilingual indexing or legal schedule preparation belongs in a human-reviewed workflow where every statement cites an immutable underlying record hash.

Cryptographic Release Verification & Bit-for-Bit Reproducibility (v0.3.7)

Every official release (starshield.pyz, .whl, .tar.gz) is accompanied by SHA256SUMS and a detached OpenSSH Ed25519 cryptographic signature (SHA256SUMS.sig) generated from an air-gapped maintainer signing key whose public verifier is distributed in KEYS.pub:

# 1. Verify detached Ed25519 signature over SHA256SUMS using standard OpenSSH (>=8.2p1):
ssh-keygen -Y verify -f KEYS.pub -I "2196305+Ziqi@users.noreply.github.com" -n file -s SHA256SUMS.sig < SHA256SUMS

# 2. Verify artifact SHA-256 digests:
shasum -a 256 -c SHA256SUMS

# 3. Rebuild starshield.pyz from source and verify bit-for-bit SHA-256 reproducibility:
python3 scripts/build_reproducible.py --verify

Governance, Assurance Case & Security Reporting

• Security Assurance Case & 12-Month Roadmap: SECURITY_ASSURANCE_CASE.md
• Vulnerability Response Policy (48h Ack SLA): SECURITY.md · GitHub Private Vulnerability Reporting
• Governance, Roles & Continuity Policy: GOVERNANCE.md
• Contribution, DCO 1.1 & Testing Standards: CONTRIBUTING.md · CODE_OF_CONDUCT.md
• Author: Ziqi Xiao (@Ziqi) — Documentation & Sample Workpaper · GitHub Issues