Artefacts in, timeline out, nothing retained
DFIR is a pile of ugly strings. Prefetch, $MFT notes, encoded commands, browser artefacts. A model that refuses them because they look like an intrusion is refusing the case.
Forensic examiners, IR firms, and internal DFIR holding images under legal authority.
Why the mainstream APIs fail here
The model will summarise a nice PDF and will not touch the encoded PowerShell that is the case. You did not need a summariser. You needed a second reader who will look at the ugly part.
How Redline is used for this
Send excerpts, not disk images. Ask for ordering, gaps, and the next artefact. Keep the receipt with the exhibit list if you have to show what left the exam machine.
A working loop
- Work from authorised images only.
- Prompt with excerpts.
- Attach the receipt to the case, not the prompt.
Prompts are not stored. A signed receipt of the hash comes back on every call, so you can prove later what Redline logged. Details are on the privacy page. Per-model prices are on /models and the pricing model is on /pricing.