Parse as a service
Dirty hives, WAL frames, EVTX salvage, timestamp normalization — the janitorial layer that used to eat the first day of every case.
Siftbench
Digital forensics where every claim resolves to evidence.
Upload a triage package. Get explorers, a timeline, and agents that answer investigative questions — with citations the API can prove.
case / acme-ransomware · command center
Needs attention
2 proposed findings · 1 agent waiting
upload → parse → cite
AIhighproposed
Persistence via Run key Updater
AImedproposed
Suspicious process lineage from chrome.exe
Agent run · lateral movement pass
waiting_for_input · scope: hosts WIN-A, WIN-B
Timeline±15m around citation
The problem
Most of an investigation is still plumbing.
Analysts shuttle CSVs between single-purpose parsers, repair dirty artifacts under deadline pressure, then correlate millions of records by hand. AI could absorb the mechanical triage — but an uncited claim is worthless in forensics.
Explore like an instrument
Purpose-built explorers and a unified timeline. Keyboard-first, dense, calm — built for examiners who live in evidence, not chat windows.
Agents that must cite
Findings without resolvable pointers are rejected by the API. Humans accept or reject. AI never launders itself into evidence.
Workflow
Upload once. Verify forever.
Collectors stay upstream. Siftbench is the elastic parse farm and collaborative workbench that turns KAPE and Velociraptor packages into citeable casework — then keeps a human on the accept button.
- 01
Ingest
Hash-locked originals, companion-aware unpacking, host topology.
- 02
Normalize
Deterministic parsers with provenance on every record.
- 03
Investigate
Explorers + timeline as the signature working posture.
- 04
Conclude
Cited findings, named acceptance, audit trail.
Evidence grammar
Evidence
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Updater
data = C:\Users\Public\updater.exe
AI
Proposed finding
Persistence established via user-level Run key writing an unsigned binary under Public.
Run\UpdaterChangelog
What just shipped
Agents with mandatory citations
M6 lands cited findings, human accept/reject, and API rejection of fabricated pointers.
Unified timeline and explorers
M5 ships the dense workbench — registry, SQLite, EVTX, plist, text/hex, and a case timeline.
Cloud parse farm for triage packages
M4 unpacks collections, maps hosts, and fans parse work across workers.
Built for the examiners who still have to testify.
Deterministic parsers as ground truth. Citations as a contract. Human judgment on every conclusion. Request design-partner access while we harden for production cases.