35 lines
1.3 KiB
Python
35 lines
1.3 KiB
Python
"""FileSystem Agent — analyzes disk structure, files, and deleted data."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from base_agent import BaseAgent
|
|
from evidence_graph import EvidenceGraph
|
|
from llm_client import LLMClient
|
|
from tool_registry import TOOL_CATALOG
|
|
|
|
|
|
class FileSystemAgent(BaseAgent):
|
|
name = "filesystem"
|
|
role = (
|
|
"File system forensic analyst. You examine disk image partition layouts, "
|
|
"directory structures, file metadata, and recover deleted files. "
|
|
"You identify suspicious files, installed programs, and user data locations. "
|
|
"You also handle malware analysis, Recycle Bin forensics, and Prefetch execution evidence."
|
|
)
|
|
|
|
def __init__(self, llm: LLMClient, graph: EvidenceGraph) -> None:
|
|
super().__init__(llm, graph)
|
|
self._register_tools()
|
|
|
|
def _register_tools(self) -> None:
|
|
tool_names = [
|
|
"partition_info", "filesystem_info", "list_directory",
|
|
"extract_file", "find_file", "search_strings",
|
|
"parse_prefetch", "count_deleted_files",
|
|
"read_text_file", "search_text_file", "read_binary_preview",
|
|
]
|
|
for name in tool_names:
|
|
td = TOOL_CATALOG.get(name)
|
|
if td:
|
|
self.register_tool(td.name, td.description, td.input_schema, td.executor)
|