# Dataset Documentation — Evidence-Locked DFIR Agent

## Dataset

`CASE-DFIR-002` is a sanitized suspicious-email triage packet created for this submission. It is not real victim data and it is not malware attribution evidence.

## What The Agent Reads

| File | Purpose | SHA-256 |
|---|---|---|
| `findevil/case_data/email_headers.txt` | Mail-routing and authentication evidence | `a022fc44326ecb090f9d8fb5bfec53eb9b3b9d968de273f65d9715c04ac425d8` |
| `findevil/case_data/attachment_hashes.csv` | Attachment reputation and evidence ID | `11576fc8d2db0fa2fac75df8a54d22e4f31da5e0663ce2a216afbaf4ebde39c9` |
| `findevil/case_data/browser_timeline.csv` | User download timeline | `4ffcd9feb76ff1746a62aada15e494e499e808d0bf866a605b3eda7fac3cb920` |
| `findevil/case_data/endpoint_processes.csv` | Process-list evidence used to reject execution certainty | `dcdca9f96fa69a57e61c9cff6548c1ef5c47a1d12720273cb8366a0aab03ee57` |
| `findevil/case_data/network_observations.log` | DNS/proxy observation context | `bc12b61d19711c09640c916b29b6042d066cac9d55cf73338bab83fc6ef0f1e3` |
| `findevil/case_data/ground_truth.json` | Expected claim statuses for self-scoring | `0e38f19b1413309548b4349142a664cddf910498a024e10cca77422ba00d814b` |

## What It Found

- Supported: phishing email, suspicious attachment, user download.
- Blocked: malware execution, because the endpoint process listing does not prove Word, macro-host, shell, or child-process execution.
- Human gate: mailbox containment is allowed only after human approval; endpoint isolation is not approved.

## Reproducibility

Run `bash findevil/scripts/run_findevil_local_checks.sh` from the repository root. The verifier regenerates the claim table, analyst report, accuracy report, execution log, source hash manifest, and demo media from the packaged artifacts.