Native macOS forensic timeline analysis. Open KAPE VHDX, EVTX, CSV, XLSX, Plaso, $MFT, $J, and local AI assistant artifacts — with source coverage, AI Secret Hunt, and practical investigation analytics.
SQLite engine with sub-100ms queries on 10M+ rows. Streams 30GB+ files with zero-copy CSV parsing, memory-capped background indexing, and single-query analytics — no loading into memory.
Scan local AI history and control-plane evidence from ChatGPT/Codex, Claude, Grok Build, Grok Bot, Gemini CLI, Cursor, Copilot, Windsurf, and Continue. Preserve prompts, tool results, policy context, source coverage, and secret-exposure evidence.
Open KAPE --vhdx collections directly on macOS. IRFlow reads VHDX and NTFS without mounting or modifying the image, extracts only recognized artifacts to scratch storage, and feeds the existing triage, Sigma, and Lateral Movement workflows.
Mixed, FTS, LIKE, Fuzzy, and Regex. Full-text search, substring matching, typo-tolerant fuzzy, and pattern matching across millions of rows.
Dual-engine Sigma scanning — bundled Hayabusa over raw EVTX plus an in-app JS engine for imported timelines, with MITRE ATT&CK-mapped triage, custom rules, and persistent scan history.
Reconstruct process trees from Sysmon and Security logs — Story/Graph/Raw views, multi-pass enrichment, ~330 chain rules + ~60 standalone detections, rule health coverage, and one-click Filter Grid pivots.
Network graph with multi-hop chain reconstruction and RDP session correlation. Detects brute force, password spray, Impacket, 33 RMM tools, and 7 network tunnels.
39 EVTX + 33 registry persistence rules with risk scoring across services, scheduled tasks, WMI subscriptions, and autorun keys.
Histogram with brush-to-filter, gap and burst detection, log source coverage maps, and value frequency stacking.
Scan against threat intel lists with 17+ indicator types — hashes, IPs, domains, registry keys, named pipes, and more. Auto-defangs and tags matches inline.
Bookmarks, color-coded tags, conditional formatting with KAPE-aware presets, and full session save/restore.
.vhdx images, reads the NTFS volume without mounting it, and copies only recognized artifacts into a temporary collection tree. The source image stays untouched.Read the v1.0.13 announcement → · KAPE VHDX workflow → · Full changelog →
terminal.value_changed (visible iTerm2 scrollback), Statsig account identity, and a corrected 48-hour purge caveat.Read the v1.0.12 announcement → · Diff Tabs workflow → · Full changelog →
Native macOS timeline analysis for DFIR — EVTX, KAPE super-timelines, and local AI artifacts in one app. Timeline Explorer–style workflow on Mac, plus built-in detection analytics and AI Secret Hunt.
Excel row limits, Windows VM overhead, or missing AI evidence — IRFlow is the macOS alternative to Timeline Explorer.
| Format | Extensions | Description |
|---|---|---|
| CSV/TSV | .csv, .tsv, .txt, .log | Auto-detects delimiters (comma, tab, pipe) |
| Excel | .xlsx, .xls, .xlsm | Streaming reader (XLSX) + legacy binary parser (XLS) with sheet selection |
| EVTX | .evtx | Windows Event Log binary format; bounded 64 KiB chunk parsing up to the format's ~4 GiB limit |
| Plaso | .plaso, .timeline | Forensic timeline database (.timeline auto-detects; falls back to CSV) |
| Raw $MFT | .mft | NTFS Master File Table — direct import for NTFS analysis tools |
| Raw $J | .$J, .usn | NTFS USN Journal (change journal) |
| KAPE VHDX | .vhdx | Read-only VHDX + NTFS extraction into the triage-collection workflow |
| AI app artifacts | folders / JSONL / SQLite / LevelDB | Scan local AI history from supported desktop, CLI, and editor assistants |
| ChatGPT Computer History | Skysight events.jsonl segments + summary .md | macOS interaction telemetry — focus, clicks, keystrokes, selections, drags (own tab, 54-column schema) |
SQLite streaming import, lazy indexing, and virtual scrolling keep 30GB+ timelines responsive. Search millions of rows without freezing — memory-capped index builds and crash-safe long-running jobs.