Evidence Pack

Capture URLs and files into hash-verified evidence packs with provenance manifests.

OSINT blogs and chat dumps lose integrity the moment someone re-downloads a page. evidence-pack writes a directory (or zip) containing the payload, fetch metadata, SHA-256 hashes, tool/runtime versions, and optional analyst notes — ready for Intercept Cell dispatches or handoff to a SOC.

Built by Cipher Cortex.

---

Quick start

git clone https://github.com/CipherCortex/evidence-pack.git
cd evidence-pack
pip install -e .

evidence-pack url https://example.com -n "baseline capture" --zip
evidence-pack file ./sample.bin -o packs/sample
evidence-pack verify packs/url_*

Manifest schema (ciphercortex.evidence-pack/v1)

{
  "schema": "ciphercortex.evidence-pack/v1",
  "created_at": "2026-09-27T04:00:00+00:00",
  "tool": { "name": "evidence-pack", "version": "0.1.0", "python": "3.14.x", "platform": "…" },
  "source": { "type": "url", "url": "…", "final_url": "…", "http_status": 200 },
  "artifacts": [
    { "path": "…", "sha256": "…", "size": 1234, "content_type": "text/html", "role": "payload" }
  ],
  "notes": "optional"
}

verify re-hashes every listed artifact and fails closed on mismatch.

Related tools

Tool	Role
lure-lineage	Fingerprint captured HTML
rmm-abuse-map	Parse RMM installers found in packs
hijacked-infra-hunt	Find where lures are hosted

License

MIT © Cipher Cortex