oss-forensics

To investigate a GitHub repository for a supply chain attack, you reconstruct the incident by collecting and correlating verifiable evidence across local git history, GitHub API data, GH Archive events, and Wayback Machine snapshots to form validated hypotheses.

Force-push detection in open-source forensics identifies rewritten git history to uncover erased commits during a repository supply chain attack, extracting deleted commit evidence paths and recovering archived pages when available.

To extract Indicators of Compromise from a compromised GitHub repository, you build an indicator list including malicious commits, paths, actors, secrets, and workflow artifacts, culminating in a structured forensic report with an evidence registry.

Yes, oss-forensics works with deleted GitHub PRs and issues by recovering deleted content through GitHub REST API data, GH Archive/BigQuery event records, and Wayback Machine snapshots to reconstruct the attack timeline.

You validate evidence integrity during a git history investigation by enforcing an evidence-first workflow with EV-ID citations and performing evidence-store SHA integrity checks to ensure all recovered artifacts remain untampered.

The best way to generate a forensic report for a repository supply chain compromise is correlating multi-source evidence with validated hypothesis gating, producing a structured report containing the chain of custody and recovered indicators.