github-evidence-kit

Collect and verify GitHub forensic evidence by pulling commits, issues, and events from the live GitHub API and GH Archive, producing structured evidence objects with built-in verification metadata for auditability.

Yes, you can reconstruct deleted GitHub content using GH Archive data. The process extracts historical events to restore removed files or commits, providing verification against original sources for incident lineage tracking.

Store and export GitHub evidence objects using a JSON-based EvidenceStore. This system serializes collected commits and events, embedding verification metadata to ensure investigations remain reproducible and auditable.

Re-verify stored GitHub evidence by loading the exported JSON collection and applying end-to-end workflows that check the evidence objects against live GitHub API and local git sources to confirm data integrity.

You need GH Archive credentials to collect evidence from that source. The evidence collection process respects GH Archive verification constraints and credentials to ensure authorized access to historical GitHub event data.