audit-forensics

What problem does it solve?

Audit and validate internal forensic tools to investigate historical incidents while preserving the original evidence integrity.

Core Features & Use Cases

• Evidence Integrity Review: Checks whether the forensic tool accesses evidence in read-only mode, avoids modifying originals, and whether it creates shadow/copy artifacts.
• Evidence Chain-of-Custody Validation: Confirms the presence of hash/checksum verification, audit timestamp recording, and whether XML-to-database cross-linking is implemented in the reports.
• SQL Safety Inspection: Detects unsafe SQL construction patterns (e.g., string interpolation) and whether the tool accepts external/untrusted SQL inputs.
• Use Case: When an incident is suspected (e.g., overwrite or data loss), run this audit to assess whether the forensic component truly protects evidence and produces defensible findings.

Quick Start

Ask the AI to audit gestor_contable/app/services/forensic_overwrite_audit.py for evidence integrity, chain-of-custody guarantees, and SQL safety, and then summarize any real findings with exact code excerpts and severity.