IRFlow Timeline 1.0.13 — AI Evidence With Provenance, Direct KAPE VHDX Triage, and Quieter Detections
Published September 8, 2026
IRFlow Timeline 1.0.13 is a forensic-boundary release. It does more than parse additional files: it records what was actually examined, distinguishes requests and configuration from proven execution, keeps large acquisitions bounded, and makes Windows detection depend on the behavior the evidence supports.
It also removes a practical macOS obstacle: File → Open Triage Collection… now opens the VHDX that KAPE creates with --vhdx, without asking macOS to mount it.
Open a KAPE VHDX directly
Choose a KAPE folder or its .vhdx from the same triage-collection dialog. IRFlow reads dynamic and fixed VHDX containers, locates an NTFS volume behind MBR or GPT, walks the live $MFT, and copies only artifacts the triage pipeline recognizes into a temporary mirrored tree.
That extracted tree enters the existing workflow: host attribution, manifest review, $MFT / $J import, Lateral Movement source selection, and the EVTX → Sigma lane. The VHDX is opened read-only; an unflushed VHDX log is replayed in memory rather than written back to the evidence.
The reader handles resident, non-resident, fragmented, sparse, and $ATTRIBUTE_LIST-split NTFS data. It reports compressed or encrypted files by path and skips them instead of emitting corrupt output. Differencing VHDX and legacy VHD images are refused with an explicit message, and free space on the configured Temp Storage volume is checked before extraction begins.
See the supported VHDX workflow and limits →
AI evidence beyond the visible conversation
The collection surface for Claude, Codex/ChatGPT, Grok Build, Grok Bot, Gemini CLI, and Cursor is substantially wider in 1.0.13:
| Product | Important evidence added in 1.0.13 | Investigation value |
|---|---|---|
| Claude Code / Desktop | Trust, permissions, hooks, MCP definitions, instructions, memory/skills, tasks/plans, file history, .claude.json backups, bridge state, and redacted desktop MCP configuration | Establishes what an agent was allowed to do, which workspaces survived only in backups, and what context shaped a session |
| Codex / ChatGPT desktop | Project trust and plugins, AGENTS.md, exec-policy rules, shell-snapshot exposure names, remote hosts/mobile pairing, memories, goals/queues, desktop breadcrumbs, Work-with-Apps pairings, Chromium history inventory, and thread-history SQLite fallback | Reconstructs prompts, commands, results, file changes, subagent activity, remote-control posture, and evidence missing from damaged or absent rollouts |
| Grok Build | events.jsonl, signals.json, config/trust, independent terminal logs, worktrees, background tasks, uploads, and automation state | Correlates permission and tool lifecycle, codebase-upload counters, worktrees, and persistent activity outside the transcript |
| Grok Bot | Account/agent persistence, typed tool calls, approvals, send journals, drafts, automation events, daemon state/logs, Sentry identity, link previews, and staged attachments | Preserves request, decision, delivery, and local-tool context without turning an approval into an execution claim |
| Gemini CLI | Immutable revisions, rewind/replacement history, project mapping, hooks, retention, Auto Memory, trusted folders, MCP/tool policy, skills, and backups | Recovers superseded or rewound content and relates it to project and policy context |
| Cursor | Role-labelled transcripts, structured tool calls/results, tool-only bubbles, hooks/MCP, plans, rules/skills, and a deterministic inventory of local SQLite stores | Finds tool activity with no display text and documents which stores were examined or omitted |
Credential files and token stores are inventoried where useful, but their contents are not read. Configuration rows describe configuration, not proof that a command ran. A permission request or approval remains a request or decision until an explicit result or independent endpoint evidence establishes execution. Cloud-only and consumer histories that are not locally qualified remain outside the claim.
“No rows” is no longer the same as “nothing happened”
Each qualified extraction now produces a source-coverage ledger. It records eligible, selected, opened, empty, unsupported, failed, and omitted sources, plus SQLite WAL/SHM/journal companions and explicit discovery limits. The UI marks partial acquisitions, and coverage metadata survives session save/reopen and the version-2 evidence-package manifest.
Live SQLite evidence is acquired through a transactionally consistent snapshot and checked before parsing. The identity of the original database and companions remains separate from the snapshot used for analysis.
That distinction matters in a report: an empty supported store, an unreadable store, a store excluded by a limit, and a store that was never collected are four different conclusions.
Large Codex histories stay bounded
The merged collector previously accumulated a large rollout's rows and full bodies in worker memory. Because a V8 out-of-memory abort in an Electron worker can terminate the application, multi-gigabyte Codex histories were a crash risk.
In 1.0.13, Codex rollouts stream line by line, merged extraction flushes to SQLite in bounded batches, and stored merged-row text is capped while the single-tool import retains the full supported body. Filesystem walking, JSONL parsing, hashing, and SQLite loops share the same cancellation signal. Wall time, first-result latency, throughput, bytes read, eligible bytes, peak RSS, and per-source completion are measured for repeatable regression checks.
Process Inspector: evidence-specific scoring
The Process Inspector now resolves Security 4688 child/parent PID roles per event, parses EvtxECmd hexadecimal PIDs correctly, and uses the actual Sysmon EID 7 loaded module or EID 11 created file during enrichment instead of accidentally scoring the host process path.
Detection also requires more of the behavior it claims:
vssadmin list,bcdedit /enum,wevtutil qe, routine WMIC queries, and similar administrative commands no longer inherit the severity of their destructive forms.- Credential-dumping tools require LSASS targeting or corroborating process-access evidence before promotion.
- Browser/DNS volume, installer file creation, Python virtual-environment modules, and normal crash/console respawns remain context instead of becoming high-severity findings by count alone.
- WinRM, DCOM, web-shell, RMM, tunnel, writable-path, and process-injection cases retain or gain coverage when their supporting behavior is present.
- Parent-child rules do not cross a PID-reuse mislink, and user-supplied Event ID filters are parameterized before reaching SQL.
Review the Process Inspector workflow →
Lateral Movement: channel, time, and account context
Consolidated event exports can reuse the same Event ID in unrelated channels. The tracker now keeps TerminalServices/RDP events separate from Sysmon events instead of allowing a Sysmon DNS or file-delete row to fabricate an RDP session. Hayabusa channel aliases are normalized, mixed timestamp renderings are ordered by their actual instant, and off-hours scoring uses the configured estate UTC offset.
False-positive controls now dampen fixed-cadence service password retries and well-known machine/application-pool/health/sync accounts, while preserving corroborated activity. Coverage was expanded for password spray against one target, alternate-credential logons, loopback-tunnelled RDP, RdpCoreTS failure bursts, RDP shadowing, and write—not read—activity against ADMIN$. Admin attribution follows the matching Logon ID rather than whichever event happened in the same second.
Review the Lateral Movement Tracker →
Export and release integrity
CSV and TSV exports now quote fields containing either LF or bare CR, preventing terminal/progress text from shifting columns on re-import. AI evidence packages keep acquisition identity, source coverage, and a reproducible restore recipe.
The full Node test suite, renderer build, documentation build, Electron runtime smoke, worker/IPC acceptance, and installed Grok Bot extraction/export gate passed for the 1.0.13 candidate. The universal application and DMG were also validated locally as signed and notarized, and the DMG staple validated successfully.
Download IRFlow Timeline → · Full changelog → · AI Query History guide →