M26 · Forensic & Watchdog

Collects digital evidence, keeps its chain of custody and watches the integrity of the system.

Benefits: Traceable, verifiable evidence handling with defensive monitoring.

Example of use: Acquire a log file as evidence, verify it later and produce a custody report.

Key capabilities

• Evidence acquisition and working copies
• Chain of custody with SHA-256
• Integrity watchdog
• Incident management and reports

Forensic & Watchdog v1.1.2. Contract contromisure (protection always active; forensic views licensed) and m26_forense (32 capabilities): evidence acquisition with read-only originals and working copies, append-only SHA-256 chain of custody mirrored in the central forensic chain, Ed25519 signature checks with MASTER public keys, a defensive watchdog (signed M33 register, file integrity, configuration, services, M21 datasets, logs), incidents with controlled transitions, correlation, analysis on copies, 10 report types. Critical operations need a signed decision in the supervision inbox. The register is tamper-evident, not a hardware-immutable store; reports have no legal value.

Prerequisites

Countermeasures: none. Forensic views: licence forense.

Declared limits

Tamper-evident, not immutable; reports have no legal value; the watchdog runs on request, not in the background.

Planned (roadmap)

• Formal closure of the integration with M31
• Telemetry events delivered by the M01 Bus Controller
• Background watchdog

Blocked by decision

• Offensive countermeasures or actions against external systems
• Covert surveillance of users, keylogging, indiscriminate content collection
• Automatic disabling of protections or destructive changes to observed components

Interconnections

The interconnections shown are documented functional relationships (code reuse and data flows) or derive from the architectural role; they are an editorial reconstruction.