Deterministic Chromium Cache Carving, Container Provenance & Source-Cited Payment Dispute Triage
starshield-forensics v0.3.7 is a cryptographically signed, bit-for-bit reproducible digital forensics CLI, library, and single-file starshield.pyz zipapp (with a 10-second air-gapped precheck gate) for inspecting uncompacted Chromium IndexedDB / LevelDB write-ahead logs (.log), validating PNG/JPEG ICC metadata structures, and verifying multi-jurisdiction payment identifiers with byte-offset provenance.
.log block framing, cross-block WriteBatch reassembly & strict boundsiCCP & multi-segment JPEG ICC_PROFILE + 8BIM verificationHMAC-SHA256 pseudonymization masking IOCs, PNG text chunks & raw file hashes1. Four-Layer Evidentiary Architecture: Deterministic Extraction vs. Human Review
In commercial payment-fraud and Authorized Push Payment (APP) disputes, counterparties frequently edit or soft-delete web-messaging instructions prior to formal preservation. Reliable pre-action triage requires isolating deterministic byte-level parsing (where generative models never touch raw evidence) from human-reviewed chronological schedules:
2. Epistemic Discipline: Separating Observed Bytes from Triage Leads
Overstating forensic certainty undermines pre-action credibility. Every output field emitted by starshield-forensics applies a four-tier provenance taxonomy (OBSERVED, DERIVED, INFERRED, UNKNOWN) separating raw byte observations from derived checksums and unverified external state:
| Artifact Class | Technical Extraction | Epistemic Tier | Mandatory Boundary & Alternative Explanations |
|---|---|---|---|
Chromium LevelDB .log |
UTF-8/UTF-16LE JSON records recovered with physical leveldb_batch_byte_offset alongside deletetime |
OBSERVED |
Reflects uncompacted local write-ahead cache only; records already garbage-collected by Chromium compaction cannot be quantified from client storage alone. |
| Financial Identifiers | ISO/IEC 7812 Luhn check-digit verification & ISO 13616 IBAN Mod-97 country-length validation | DERIVED |
Confirms mathematical check-digit validity and intra-message proximity (≤120 chars), not account ownership or settlement completion. |
| PNG / JPEG Containers | CRC-verified PNG iCCP / multi-chunk JPEG APP2 ICC headers (acsp) and APP13/8BIM offsets |
DERIVED |
Consumer OS screenshot pipelines routinely embed Display P3 or sRGB profiles; container metadata indicates pipeline touch, never standalone proof of document forgery. |
| Session & UTC Intervals | Timezone-aware ISO-8601 delta calculation rejecting naive timestamps and negative clock skew | DERIVED / INFERRED |
Cross-endpoint intervals depend on NTP clock synchronization; CDN/edge tags reflect network routing rather than physical operator geolocation. |
Compacted .ldb & Server State |
10-second precheck detection of Snappy SSTables (0xdb4775248b80fb57) & Blink 0xFF envelopes |
UNKNOWN |
Records evicted into compacted SSTables or held only on upstream SaaS/bank servers are explicitly marked UNKNOWN rather than silently omitted. |
3. Pre-Action & PSP/FOS Evidentiary Triage for UK & HK Dispute Practices
In UK Authorized Push Payment (APP) reimbursement claims—strictly within PSR Specific Direction 20 Faster Payments scope (for consumers, micro-enterprises, and small charities with annual income under £1m where funds reach a recipient account not controlled by the consumer) and Financial Ombudsman Service (FOS) fairness reviews—as well as commercial supplier invoice-diversion disputes, solicitors require auditable, byte-offset-cited factual schedules rather than unstructured screenshot bundles.
Engagements operate strictly on pre-agreed fixed-fee tiers by artifact volume (non-contingent) under written UK GDPR Data Processing terms, with a law-firm local execution option where the stdlib-only parser runs directly on the firm's workstation (subject to DPO assessment for any remote VDI or pseudonymized output review). Inspect the reproducible 2-page 100% synthetic Sample Evidentiary Triage Workpaper (PDF) directly in your browser.
4. Open-Source Code, Synthetic Benchmark Suite & Pilot Inquiries
1. Open-Source Toolkit (v0.3.7 · OpenSSF Silver & Scorecard 7.1)
Inspect the pure-Python LevelDB .log multi-schema carver, 10s precheck gate, Ed25519-signed starshield.pyz, OpenSSF Silver (#16602, 226%) & Scorecard (7.1/10), Concept DOI 10.5281/zenodo.24145804, NIST IR 7608 Security Assurance Case, and 25 adversarial & canary unit tests.
2. StarShield-Bench-24 & OWASP GenAI Suite
24 seeded synthetic benchmark cases scoring byte-offset citation fidelity and indirect prompt-injection survival (plus 12 EN/ZH financial-triage cases contributed upstream to OWASP GenAI Data Security Initiative PR #119).
View Benchmark Suite3. Scoped Fixed-Fee Law Firm & DFIR Pilots
Client IT runs python3 starshield.pyz precheck locally in 10s first (£0 if compacted NO_GO; £850 on Firm PO / Net-7 for 3-day Micro-Pilot; £1,650–£3,500 Standard Tiers). Never post client data on public GitHub Issues.