# Coverage

What each check reads and where its limits are. This is not a measure of real-world
detection or false-positive rates.

Run `--describe` for the full check catalogue. Each report lists the checks that actually
ran and the gaps found on that input.

Browsers are looked for at their default locations (on Linux, also common Snap and
Flatpak packages, snap data in its current revision folder, and Firefox 147's
`~/.config/mozilla/firefox`):

- **Chromium-based:** Chrome, Edge and Brave (stable, beta, dev, canary and nightly
  channels), Chromium, Vivaldi, Opera, Opera GX, Arc and Yandex.
- **Firefox-based:** Firefox, LibreWolf, Waterfox, Floorp, Zen, Pale Moon and Tor Browser,
  each reported under its own name. Portable installs elsewhere are not discovered.
- **Safari:** macOS only.

| Check family | Reads | Limits |
|---|---|---|
| Chromium browsers and desktop apps | History, bookmarks, cookies, favicons, site storage, connection records, HSTS, download URL chains; separate standard Linux/macOS browser caches (and Opera's on Windows); raw app caches in full mode. Desktop apps are found by folder contents with no fixed depth limit | Open/locked files, deleted data, schema changes. Bookmarks and raw cache strings are references. Download hosts are attempted or contacted according to status and bytes received; neither proves execution. Explicit targets do not expand into an unselected separate cache. App discovery is bounded by folder count and time; reaching the bound is a gap. |
| Firefox family | History, cookies, favicons, cache, text and binary HSTS stores | Partition metadata is not treated as the contacted host. |
| Desktop Safari | Main and profile `History.db` visits on macOS, or selected copies. From the Safari sandbox and `~/Library/Safari`: cookies and HSTS (contacted); tabs, iCloud tabs, URL cache, WebKit `observations.db`, bookmarks, Top Sites and recently closed tabs (references); downloads (contacted or attempted by bytes received) | Unknown visit origin or load status stays a reference with a gap; saved references and synced visits do not establish local contact. Damaged stores are gaps. Selected copies cover `History.db` only. |
| File fingerprints | Platform-specific user, application and temporary roots; Windows candidate extensions; on Linux/macOS also extensionless/executable files, native libraries and scripts; all extensions in full/targeted mode | Exact known hashes only; 120 MiB per file; inaccessible paths. Full mode does not cover all drives or accounts. |
| Windows host and existing traces | DNS, COM, download origins, Win+R, Defender, PowerShell event logs, ShimCache and PCA | Logging may be disabled; records expire. ShimCache shows presence, not execution. |
| Windows antivirus status | Product names, states and signature status from Windows Security Center, with no vendor allowlist | Windows 8 or later desktop API; Windows Server and unregistered products are not covered. Reported state is not an independent health test or proof of protection at past event times. API failures are gaps. |
| Added Windows records | PSReadLine, Explorer TypedPaths, Run/RunOnce, services, Startup files including supported `.lnk` metadata, task actions; opt-in Sysmon/Security events | Rights and logging affect coverage. BAM and SRUM are unsupported. Saved input and arbitrary Startup text are references; recognised batch commands, Internet Shortcut URLs and literal shell-link launch metadata are persistence configuration. Targets are never accessed or resolved. Shortcut IDLists, unfamiliar blocks/flags, ambiguous ANSI encodings, expansions, unsupported batch syntax and other unknown formats are gaps. |
| Windows Prefetch and Amcache | Supported SCCA Prefetch layouts and allocated Amcache hive records, live on Windows or from selected copies on any OS | Prefetch executable names are `execution-record`, not full-path or content identification; metric paths are references. Amcache is `inventory-record`, never proof of execution or current presence. Compressed Prefetch needs Windows; dirty hives need transaction-log replay, which is unsupported. Locked files, unsupported layouts and exhausted bounds are gaps. |
| Linux startup configuration | Standard user/system autostart `.desktop` files, systemd units and one-level `.d/*.conf` overrides, readable cron configuration (including BusyBox `/etc/crontabs`) and hourly/daily/weekly/monthly script directories. Links are not followed; masked units and aliases of inspected files are not gaps | Unit/cron text and network strings are references. Only supported unconditional desktop executable paths can be configured evidence. No activation or effective-override resolution, recursive script execution, binary journal analysis or other users' homes. |
| macOS startup configuration | Standard user/system LaunchAgent and LaunchDaemon XML/binary property lists, including Apple's App cryptex folders; literal `Program`/`ProgramArguments`, compared as an executable path and, by file name, as a process name | Configuration does not establish activation or execution. No managed login items, unified logs or memory. Unsupported or unreadable files are gaps. |
| Unix shell records and text logs | Standard Bash/Zsh/fish startup files and saved history, including macOS Terminal's per-session `~/.zsh_sessions` / `~/.bash_sessions` history; selected current Linux syslog/auth files and macOS `system.log`. Executable paths are matched as shell words, including inside `$( )`, backticks and after `;`, `\|`, `&` | References only. At most the recent 4 MiB per file is kept and older records are reported as omitted. No custom history locations, unsaved sessions, rotated/compressed logs or binary/unified-log decoding. Permissions and read/count limits leave gaps. |
| Unix hosts file | `/etc/hosts` on Linux, `/private/etc/hosts` on macOS | An indicator pointed at a real address is configured evidence; one pointed at a block address (0.0.0.0, loopback) is protective and only counted. |
| Guided Android acquisition | Pinned official AndroidQF download, owner consent, local ZIP extraction, optional public age recipients | The collector changes device state. Windows collector unsigned; SHA-256 is publisher integrity, not an independent audit. Encrypted archives need separate decryption. |
| AndroidQF folders | Apps, process inventories (`processes.json`, `processes.txt`, or `ps.txt` from older AndroidQF), settings, files, logs, crashes, install history and SMS/MMS backup | Collection permissions and Android versions limit what is present. JSON processes need a positive integer `pid` and a `command_line` string array; only the first command names the app. Only inbox messages are `received`; sent, draft and failed messages are references. MMS attachments are not opened. Certificate coverage gaps count SHA-256 and SHA-1 separately. Archives must be extracted first. Encrypted SMS needs the password; legacy password encodings may be unsupported. |
| Android intrusion logs | Decrypted newline-JSON `.txt` exports and supported ZIP members: DNS events, TCP connection attempts, process-start security events | Logging may be off or absent. DNS is `dns-record`; connection attempts and process records are `device-log`, not proof of successful contact. Unknown events/schemas and encrypted input are gaps. No live collection or decryption. |
| iPhone local evidence | Local backups, independently encrypted artifacts/WALs, extracted file systems and selected sysdiagnose TAR/directory artifacts: messages, profiles, browser and process records, running-process lists, installation logs, metadata and diagnostics (see [IPHONE.md](IPHONE.md)). Table layouts of iOS 15, 16, 17 and 18 are in the test suite | Unsupported schemas or encoded-message variants, damaged WALs, encrypted root-manifest WALs, unavailable protection classes and record caps are gaps. No live/cloud acquisition, deleted-record recovery or unified-log decoding. Source hashes identify bytes read, not device authenticity. |
| Indicator files | Curated sets, downloaded feeds and STIX bundles; a STIX `file:name` holding a full path is used as a path | Missing or refused sources are reported, and each source's age is shown; stale or undated sets are flagged. An update that would cut a source's indicator count by more than half, or to zero, is refused and the previous copy kept; `--update --accept-shrink SOURCE_ID` accepts a genuine change. |
| Context and related records | Publisher assertions, validity dates, withdrawal labels and matching records across artifacts | Publisher labels are not independent corroboration. A validity period is not necessarily a campaign period. Related records do not establish causation. |
| Report inspection and saving | Completed findings, references, gaps and fixed advice; readable report, full JSON and minimal sharing summary | No extra detection happens in the menu. Quitting before a scan returns `4`, not a clean verdict. Reports never replace existing files in selected evidence or in app data and app cache folders. |
| Private evidence handoff | Full reports, indicator fingerprints and explicitly selected local files in a ZIP with an integrity manifest | Unencrypted and never uploaded. Up to 128 files, 64 MiB each, 256 MiB total payload including reports. Files are copied at export time, not kept from the scan; hashes do not prove original authenticity or infection. |
| Optional file patterns | The separately documented Candiru rules ([PATTERNS.md](PATTERNS.md)) | Experimental; no memory scan or automatic dependency installation. |