{"id":51015113,"url":"https://github.com/securityronin/state-history-forensic","last_synced_at":"2026-06-21T09:02:51.348Z","repository":{"id":365631172,"uuid":"1270382082","full_name":"SecurityRonin/state-history-forensic","owner":"SecurityRonin","description":"State-history forensic vocabulary — zero-dependency [H] KNOWLEDGE-tier types and traits lifting each forensic navigation primitive to a time-indexed variant. No deps, no I/O.","archived":false,"fork":false,"pushed_at":"2026-06-18T06:20:59.000Z","size":30,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-18T08:15:56.300Z","etag":null,"topics":["dfir","digital-forensics","forensics","incident-response","rust","state-history","temporal"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SecurityRonin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-15T16:54:20.000Z","updated_at":"2026-06-18T06:21:03.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/SecurityRonin/state-history-forensic","commit_stats":null,"previous_names":["securityronin/state-history-forensic"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/SecurityRonin/state-history-forensic","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fstate-history-forensic","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fstate-history-forensic/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fstate-history-forensic/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fstate-history-forensic/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SecurityRonin","download_url":"https://codeload.github.com/SecurityRonin/state-history-forensic/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fstate-history-forensic/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34603657,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-21T02:00:05.568Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dfir","digital-forensics","forensics","incident-response","rust","state-history","temporal"],"created_at":"2026-06-21T09:02:50.478Z","updated_at":"2026-06-21T09:02:51.330Z","avatar_url":"https://github.com/SecurityRonin.png","language":"Rust","funding_links":["https://github.com/sponsors/h4x0r"],"categories":[],"sub_categories":[],"readme":"# state-history-forensic\n\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)\n[![Docs](https://img.shields.io/badge/docs-mkdocs-blue.svg)](https://securityronin.github.io/state-history-forensic/)\n[![Sponsor](https://img.shields.io/badge/Sponsor-h4x0r-ea4aaa?logo=githubsponsors)](https://github.com/sponsors/h4x0r)\n\n**The zero-dependency `[H]` state-history vocabulary for the SecurityRonin forensic fleet — the KNOWLEDGE-tier types and traits that lift every navigation primitive to a time-indexed variant.**\n\n`state-history-forensic` is a pure type/trait leaf: no parsing, no I/O, no dependencies. Concrete `[H]` crates (`vss-history`, `wal-history`, `git-history`, …) implement `HistoricalSource` and depend *down* onto it.\n\n```toml\n[dependencies]\nstate-history-forensic = \"0.1\"\n```\n\n## The `[H]` functor\n\n`[H]` lifts each base navigation primitive to a time-indexed variant:\n\n| Lifted primitive | Time-indexed source |\n|---|---|\n| `[P^H]` disk | VSS, APFS snapshots, Time Machine, btrfs |\n| `[M^H]` memory | hiberfil chain, VMware memory snapshots |\n| `[L^H]` log | rotated logs, journald sealed epochs |\n| `[Q^H]` query | point-in-time osquery exports |\n| `[C^H] ≅ [C]` | Git already encodes history — `[H]` on `[C]` is the identity |\n\n## What's in the crate\n\n| Module | Provides |\n|---|---|\n| `identity` | `ArtifactRef` + `IdentityClaim` multi-facet identity, `IdentityDiscipline` selector |\n| `clock` | `ClockProvenance` — four orthogonal axes (source / trust_grade / tamper_resistance / ordering_only) |\n| `epoch` | `EpochTag`, `LsnKind` ordering keys (e.g. salt-qualified SQLite WAL frames) |\n| `cohort` | `TemporalCohort\u003cH\u003e` / `TemporalState\u003cH\u003e`, `CohortTopology`, `MaterializationSafety` |\n| `source` | the `HistoricalSource` trait, `AcquisitionProtocol`, `StateMaterializer` boundary |\n\n## Design\n\n- **Zero external dependencies** — a pure KNOWLEDGE leaf. Every `[H]` crate depends down onto it; it depends on no one.\n- **Generic over a source-defined handle `H`** — `TemporalCohort\u003cH\u003e` orders states by `wall_time` (else ordering key), with no trait-object overhead.\n- **Trust is multi-axis, not a flat level** — \"local but signed\" (iOS APFS) is structurally distinct from \"external + attested\" (Sigstore).\n\n---\n\n[Privacy Policy](https://securityronin.github.io/state-history-forensic/privacy/) · [Terms of Service](https://securityronin.github.io/state-history-forensic/terms/) · © 2026 Security Ronin Ltd\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fstate-history-forensic","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecurityronin%2Fstate-history-forensic","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fstate-history-forensic/lists"}