IRFlow Timeline 1.0.8 — AI Application Forensics Expanded
Published July 27, 2026
IRFlow Timeline 1.0.8 significantly expands AI application forensics. Investigators can now recover more local AI-native evidence, preserve the commands and tools used by coding agents, and correlate that activity with the rest of an endpoint timeline.
Grok Build support
Grok Build is a new native evidence source in v1.0.8. IRFlow parses the local .grok session store into the same AI Query History schema used by other assistants.
The parser recovers:
- Timestamped prompts, assistant responses, and reasoning records
- Direct shell entries and exact
run_terminal_commandinputs - Completion status, working directory, exit code, and bounded terminal output
- Session, model, workspace, Git, sandbox, and token metadata
- File-hunk records showing paths and added or removed lines
IRFlow deliberately excludes Grok credential files such as auth.json and mcp_credentials.json from timeline text. Consumer Grok web/mobile conversations are also separate from Grok Build and require browser-origin evidence or a vendor export.
Deeper Claude and Codex evidence
- Claude Code and Claude Desktop/Cowork — recursively parses project and subagent sessions, isolated Cowork transcripts, audit records, tool calls, and actual shell commands.
- OpenAI Codex — parses dated and archived rollout JSONL plus versioned
state*.sqlitestores. WAL/SHM companions are acquired with the database so recent thread, spawn-edge, and dynamic-tool metadata is not silently missed. - Modern tool evidence — exact commands, structured tool inputs, descriptions, and useful tool results are retained with explicit size caps for stability.
- Broader coverage — parsing is also improved for ChatGPT Desktop, GitHub Copilot CLI and VS Code, Gemini CLI, Cursor, Windsurf, and Continue.
More than AI artifacts
Version 1.0.8 also adds Open Triage Collection, upgrades Process Inspector with Story/Graph/Raw investigation modes and rule-health context, and strengthens multi-source Persistence and Lateral Movement analysis.
Large queries and background jobs now use bounded workers, cancellable lifecycles, and streamed results to reduce Electron memory pressure on large collections.