oss-forensics

Investigate supply chain compromise by running a multi-phase forensic workflow that collects evidence, extracts indicators of compromise, and validates hypotheses using GitHub history and public archives.

Recover deleted commits after a force push by detecting rewritten history and retrieving erased artifacts using GitHub commit access methods, the GitHub API, GH Archive, and Wayback Machine.

Evidence-validated reporting enforces an evidence-first approach by assigning evidence IDs, maintaining strict per-agent data-source boundaries, and verifying that cited evidence is independently corroborated before concluding compromise.

Extract indicators of compromise from a compromised repository using specialist sub-agents that collect and enrich artifacts like malicious commits, files, actors, domains, and secrets into a structured forensic report.

OSS forensics works with workflow injection and actor compromise scenarios by applying repository history analysis and public archive evidence collection to reconstruct incidents and validate security hypotheses.

Recovering deleted GitHub issues and PRs depends on whether artifacts were captured by public archives like GH Archive or Wayback Machine before deletion, as force-push cleanup can permanently erase uncached evidence.