Newsletter #1

Welcome

This is the first Sprite newsletter, so a quick intro before we get into it. Sprite is a cloud-native forensic processing platform. Evidence goes in, gets processed in parallel across as many plugins as you need, and the results come out in an open format that any frontend, reporting tool, or AI model can work with. Infrastructure scales to the job and goes back to zero when it's done.

These newsletters will cover what we've been building, what's coming next, and the occasional bit of commentary on how we think forensic tooling should work. No fluff, no filler.

It's been a busy couple of months. Here's what's new:

E01 Image Viewer

Most of your evidence in Sprite will come from processed artefacts, which is where the real analytical value sits. There are still times when you want to open up the disk image itself and have a look around, though.

The problem to solve is that Sprite is web-based, and the image lives in S3 for most of its life (cheaply, which is the point). S3 is object-based storage, and while you can technically pull a block at a time from it, the performance is terrible for this kind of access pattern.

We've solved that with a combination of sleuthkit, just-in-time volumes, and a nifty bit of storage management. The result is a browser-based disk image viewer that lets you navigate through an E01 as you'd expect from a forensic tool. When you're not using it, everything scales back down. No idle infrastructure, no ongoing cost. True to Sprite's principles, it all goes to zero.

iLEAPP Plugin Conversions

We've refactored all the iLEAPP plugins to work with Sprite. Thanks to Alexis B and the LEAPP team here. After a little jiggery-pokery to get everything aligned, a test run through has made really good progress. There's a conversation view set up that shows the principles nicely, and this is a solid step toward having a comprehensive mobile artefact capability running natively in the platform.

Tempest: eDiscovery Reporting

Tempest is our first reporting plugin, and it came about because one of our early testers asked for it. We turned the core of it around in 48 hours, which was as much a test of how fast you can develop against Sprite's API and specs as it was about creating the plugin itself.

What it does: Tempest reads a set of bookmarks created by a user, Bates stamps those items, and exports them to TIFF or PDF. If an item fails, it generates a slip-sheet. There's still work to do on text extraction and OCR, and we need to make sure we can handle and create formats like RSMF properly. It's in a reasonable place, though, and it's a good proof point for what Sprite's plugin architecture can do when you point it at a real-world workflow.

Plugin Roundup

A few more plugins that have landed or are in progress:

HEIC2JPG and H.265 Transcoder

Frontend helper plugins for media conversion. The HEIC converter already has a real-world deployment: we quickly refactored it for an eDiscovery client whose software couldn't display HEIC files. They drop files into an S3 input folder and get JPGs back in the output folder within seconds. Quick overlay or replacement and they're done. (Needless to say our engineering browser does this on-the-fly for images and can transcode in the background for video)

Keyword Search

We've wrapped Bulk Extractor in Go with some tweaks so that it creates an observable and structured output. A frontend can display those results quickly, and because it's Sprite, the results don't contribute to some ever-growing case file that takes longer and longer to open. Ten hits or ten million, it doesn't matter.

Exiftool Integration

Wrapped in a similar way, and we've modified the pipelines so that images and videos automatically get their EXIF data extracted on ingest, that exif data is included in the observable so a query like 'show me all the photos taken on x date' becomes trivial to run.

File ID Pipeline

Files that aren't identified and processed correctly on first pass get pushed through the ID pipeline. Using Sprite's declarative routing, those observable records get patched and sent to the correct downstream process automatically. This is an enrichment that Sprite can provide to any plugin.

PST Parser

In progress, along with a decent starter set of plugins for Windows artefacts.

All of these processes run in parallel. As soon as Sprite creates an observable, it's available. There's no waiting for all processes to finish before you can start working.

Bookmarks

This one sounds plain on the surface, and yes, we were all bookmarking evidence back in EnCase 3.22. The difference here is in what you can do with them and who owns that data.

It doesn't matter whether a person or a plugin creates the bookmark. It's viewable by any tool or frontend that connects to Sprite. No vendor lock-in, no proprietary case file format that'll need a licence to open in a few years (assuming it's even still supported by then). Your reviewers can bookmark relevant data in their own customised, cut-down frontend and that's immediately available to you.

Sprite supports up to 100 bookmark categories per case, each with an assignable colour and description. You can bookmark artefacts and observables, and create as many as you need (soft limit of 10,000 per category). Every bookmark tracks who or what created it and when, so queries like "show me all the red bookmarks created by JohnInvestigator in the last two days" work out of the box.

The part that ties it all together: you can run plugins on bookmark sets. Select some data, bookmark it, and run further enrichment or reporting against that selection. That's where Tempest plugs in, and it opens up a lot of other workflow possibilities.

Hash Set Management

Managing hash set databases is one of those overheads that nobody enjoys and everybody has to deal with. We're building a solution into Sprite that takes that off your plate entirely.

Take and use a public hash set like NSRL, upload your own and make it available to the Sprite community, or upload a set and keep it private to your organisation. Either way, Sprite manages the database for you. No local installation, no maintenance, no syncing across machines. Import once, and every app and plugin on the platform has access. No more duplicating hash sets across different tools.

We're also working on something that should significantly speed up hash lookups. More on that when it's ready.

What's Next

PST parsing and Windows artefact plugins are in active development. We'll have more to share on Tempest's progress, and the hash set performance work should have some results worth talking about.

That's it for this one. If you've got questions, feedback, or something you'd like to see covered, drop us a line at info@wesdx.com or connect on LinkedIn. We read everything.