oss-forensics

Supply-chain forensics works by cross-referencing local git history against GitHub API data, GitHub Archive events, and Wayback Machine snapshots to detect evidence erasure. It collects structured evidence to identify force-pushes, recover deleted commits, and trace contributor anomalies into a defensible narrative.

Detecting force-push and deleted commits requires cross-source verification between local git history and remote GitHub Archive events. By comparing local repository states against archived event logs, you can recover erased commits and identify unauthorized history rewrites caused by supply-chain tampering.

Wayback Machine snapshots serve as external evidence to recover erased GitHub repository data during supply-chain forensics. Cross-referencing these snapshots with GitHub API data and local git history verifies historical repository states and detects evidence erasure or tampering.

Analyzing GitHub workflow abuse and suspicious releases requires correlating contributor anomalies with release timelines using GitHub Archive events and API data. This forensic approach enriches indicators of compromise to reconstruct the attack timeline and produce a citation-backed report.

GitHub supply-chain forensics requires chain-of-custody documentation to maintain a defensible forensic narrative. Structured evidence collection organizes recovered commits, force-push detections, and Wayback snapshots into a citation-backed final report with validated hypotheses and timelines.