AI Agent · Intelligence

Eye AI
The Forensics AI Assistant

Meet The Eye — Crow-Eye's AI forensics assistant for AI-powered Windows DFIR and AI cybersecurity investigations. It automates and verifies your findings, in the cloud, fully offline, or from the terminal.

Download Free Explore The Eye

What is The Eye?

Eye is a skilled Forensics Investigator with a real knowledge base of Windows forensic artifacts, grounded in Eye-describe. Built to automate and verify any hypothesis an investigator has, Eye AI is a powerful assistant — not a replacement. It empowers human analysts to validate findings faster and with higher precision across digital forensics and incident response (DFIR).

AI-Powered Digital Forensics

Eye AI reads raw Windows artifacts the way a seasoned analyst does — correlating execution, file, and timeline evidence to confirm or rule out a hypothesis in seconds.

Watch Eye Think

No black box. Eye streams every reasoning step to the screen as it works — and records the full Eye ↔ model conversation and every context decision so you can audit exactly how a conclusion was reached.

STEP 01

Thinking

Eye interprets your question, detects the forensic targets, and forms an investigative plan.

STEP 02

RAG

It pulls the relevant Windows-artifact knowledge from its grounded knowledge base.

STEP 03

Tool Call

It runs real tools — SQL, search, correlation, threat intel — against your case data.

STEP 04

Synthesis

It writes an evidence-linked conclusion under the Ghassan Elsman Protocol.

A live Eye ↔ LLM transcript shows the raw exchange, and every context decision is written to an append-only truncation_audit.log — so the investigator, and a court, can see precisely what the model was shown.

Three Ways to Run The Eye

Eye is model-agnostic: it brings the forensic brain — RAG knowledge, the Ghassan Elsman Protocol, the toolkit, and the evidence seal — and you bring the model. Connect it to a cloud frontier model, a private local server, or an AI CLI you already use. Same investigator, your choice of engine and threat model.

Cloud AI Models

Point Eye at the public frontier models you already have keys for — the most powerful reasoning for deep, complex cases, over each provider's official SDK.

Connects to OpenAI (GPT) · Anthropic (Claude) · Google Gemini
Fastest setup — just an API key. Native tool-calling and live quota tracking.

Local / Offline AI Server

Run a private model server on your workstation or a dedicated lab box. Modern JSON/REST comms like the cloud, but your evidence never leaves the network — fully air-gapped.

Connects to Ollama · LM Studio  —  localhost or LAN server
Air-gapped and shareable: one AI server, many analysts. Native tool-calls.

CLI AI Agents (eye-agent)

Point eye-agent at an AI command-line tool you already run — Eye drives it for terminal-first, rapid triage and incident response.

Connects to Claude Code · Gemini CLI · ChatGPT CLI · Jules · Llama.cpp · Ollama · custom
Simplest setup — reuse the AI CLI subscriptions you already pay for. Works fully offline.

AI for Cybersecurity & Incident Response

When an incident hits, speed and certainty decide the outcome. Eye AI brings AI cybersecurity firepower to the responder's desk — triaging endpoints, surfacing program execution and lateral-movement evidence, and verifying the timeline so your team can scope and contain faster. The Eye keeps the analyst in control: every finding is evidence you can corroborate, not a black box.

How Eye Is Different

Most "AI for forensics" tools bolt a chatbot onto your logs. The problem isn't answering questions — it's trusting the answer. Eye is built for evidence you can defend in court.

The Eye

  • Court-defensible. Every payload the model sees is sealed with a SHA-256, hash-chained EvidenceSeal — provenance down to database:table:rowid and the exact MFT offset.
  • Evidence-linked. Under the Ghassan Elsman Protocol, every statement must map to a real database record — exact timestamps, SIDs, and paths. No fluff.
  • It refuses to guess. Rather than silently truncate or hallucinate, Eye protects evidence and refuses when it can't fit the facts — then falls back to whole-artifact analysis.
  • Whole-artifact reasoning. Map-reduce analyzes an entire MFT or USN journal — every row covered once, each chunk sealed.
  • Fully offline. Air-gapped local models — sensitive evidence never leaves the building.
  • Open-source & free (GPL-3.0). Auditable by anyone.

Generic AI-on-logs tools

  • Answers you can't prove — no record of what the model actually saw.
  • Summaries and confident guesses that hallucinate details an investigator can't corroborate.
  • Silently drop or truncate data to fit the context window — evidence quietly lost.
  • Limited to whatever fits in one prompt; large artifacts get sampled, not analyzed.
  • Cloud-only — your evidence leaves your control.
  • Closed black boxes you have to take on faith.

Verifiable by Design — the Evidence Seal

Every payload sent to the model is sealed: the SHA-256 of the exact bytes, the token count, and per-row provenance down to database:table:rowid and the computed MFT offset. Seals are append-only and hash-chained — altering or removing any record breaks the chain, and the compliance panel flags it VERIFIED or BROKEN.

seal_hash : a91f…3c7e prev_seal : 7b20…11da ← chain intact sha256(bytes) : e3b0…b855 tokens : 7,412 evidence : amcache.db:entries:4821 (MFT offset 4,936,704) truncated : false

Never Loses Evidence — Self-Healing Context

Eye measures the full payload and reserves room for the reply before it calls the model. If it would overflow, it heals on a working copy — and it will not cut corners on evidence.

Summarize, then drop

Only non-evidence chat history is summarized or dropped to make room — pinned items, tool results, and evidence are protected and never touched.

No silent truncation

If the irreducible evidence still won't fit, Eye refuses rather than quietly drop facts — every trim is logged to the audit trail.

Whole-artifact fallback

It hands off to map-reduce — analyzing an entire MFT or USN journal in sealed chunks, every row covered exactly once.

One Assistant, a Full Forensic Toolkit

Eye doesn't just chat — it acts. Behind every answer is a governed set of 26 real forensic tools: it queries databases, hunts artifacts, drives the Correlation Engine, pulls live threat intelligence, and writes the report — each call evidence-linked and logged. Here is everything Eye can do, grouped by job.

Investigate

query_databaseRun a SQL SELECT against any forensic database. Result sets over 1,000 rows are TOON-compressed to a statistical summary plus sample rows, while the full table stays in the UI viewer.
analyze_large_datasetMap-reduce an entire artifact — a full MFT, USN journal, or huge event batch — in token-sized chunks. Every row is covered exactly once and each chunk is evidence-sealed.
search_artifactsGlobal literal or regex hunt across every indexed database at once — find a string, hash, IP, or pattern everywhere it appears.
get_schemaIntrospect a table's columns and types. Eye calls it automatically to recover from a schema-mismatch and retry the query.
list_case_filesBrowse the case directory to discover available artifacts — with path-traversal protection that keeps access inside the case root.

Correlate & author

query_correlation_resultsQuery the Crow-Eye Correlation Engine directly — by time window, by identity (user / process / file), or for case-wide statistics.
correlation_create_wingAuthor a brand-new correlation rule (Wing) when it spots a recurring pattern — GEP-governed: a written reason and evidence reference are mandatory.
correlation_edit_wingRefine a Wing Eye previously authored. Built-in and human-authored Wings stay strictly read-only to the agent.
correlation_create_semantic_mappingTurn a raw technical value into a human-readable forensic meaning, as a single mapping or a multi-condition rule.
correlation_edit_semantic_mappingEdit a mapping or rule Eye created — every change reason-stamped and appended to its edit history.

Intelligence & web

query_threat_intelLook a binary or driver up against live threat-intelligence feeds to flag known-bad or vulnerable components.
query_living_off_the_land_intelCheck a name against LOLBAS, LOLDrivers, LOFL (fileless), and malicious-bootloader datasets — the heart of living-off-the-land detection.
internet_searchFallback web research for techniques or threats not covered by local RAG or the intel feeds.
fetch_web_contentFetch a specific technical page — restricted by an SSRF-safe whitelist of trusted forensic / anatomy domains.

Report & visualize

report_append_sectionAdd a Markdown narrative section to the Living Report.
report_add_data_tableInsert an interactive, sortable table populated straight from a query.
report_add_chartGenerate a bar, line, or pie chart from the findings.
report_add_timelineBuild a chronological event timeline of the investigation.
report_add_heatmapRender an activity heatmap to expose bursts and patterns over time.
report_add_chain_of_custodyEmbed the evidence and seal trail directly into the formal record.
report_add_imageAttach screenshots or exhibit images with captions.
report_add_chat_transcriptDocument the reasoning or investigator dialogue inside the report.
report_edit_section / report_delete_sectionRefine or remove report blocks as the case evolves.
export_reportExport the workspace as interactive HTML, formal PDF, or Obsidian-ready Markdown — behind a human-in-the-loop confirmation.

System

switch_modelChange the active AI backend mid-investigation — jump between a cloud model, a local server, or a CLI agent without losing the case.

The Living Report Workspace

Every answer Eye gives is produced twice — once as a chat reply, and once as a structured block in the case dossier. Your report writes itself as you investigate, then exports as interactive HTML, formal PDF, or Obsidian-ready Markdown (with your sign-off).

Narrative sections Data tables Charts Timelines Heatmaps Images Chat transcripts Chain-of-custody References

The Ghassan Elsman Protocol

The GEP is Eye's forensic standard — a "forensic integrity boundary" enforced in code, not left to the model's goodwill. It governs both how Eye answers and how it writes, so its output is admissible by construction.

How Eye must answer

  • Chronological. Findings are delivered as a clear timeline of events.
  • Specific. Exact timestamps, usernames, SIDs, process details and paths — never vague summaries.
  • Evidence-linked. Every statement ties back to a real database record.
  • Cross-source corroborated. Conclusions must rest on combined evidence — where sources agree, stay silent, or conflict — not a single artifact.
  • No fluff. Always a direct answer; never an empty or filler response.
  • Dual output. Every answer is both a chat narrative and a documented report block.

How Eye must author

  • Reason-Required. Every rule Eye creates or edits must carry a written forensic justification, or the handler refuses it.
  • Evidence-Link. Each authored rule must cite at least one database:table:rowid reference.
  • Eye-Stamped. Every artifact Eye persists is signed with its authorship, reason, and full edit history.
  • Read-only on others. Eye cannot modify human-authored or built-in rules — it may only edit what it created. The analyst stays in command.

Total Accountability — the Compliance Panel

Eye doesn't just give answers — it keeps the receipts. Every reasoning step, tool call, and context decision is recorded and surfaced in a per-case Compliance Panel you can open, replay, and hand to a reviewer or a court.

Per-answer GEP compliance

For every question, a pass/fail on the Ghassan Elsman Protocol — was the answer evidence-linked and specific?

Evidence seals

The hash-chained SHA-256 seal of every payload the model saw, with a VERIFIED / BROKEN integrity check and a "view full payload" drill-down.

Chain-of-custody events

Every context decision logged: PRESERVED · SUMMARIZED · TRUNCATED · PINNED · REFUSED_OVERFLOW — processed vs dropped, in full.

Execution steps & tool calls

The ordered timeline of what Eye actually did — each tool invocation and decision, step by step.

Eye ↔ LLM transcript

The full raw conversation between Eye and the model — exactly what was asked and answered.

Activity audit log

A chronological record of the whole investigation, so the case can be reconstructed end to end.

None of it is in-memory only. Every record is written to append-only EYE_Logs/ files on disk:

eye_payload_seal.jsonl truncation_audit.log eye_step_log.jsonl eye_gep_turns.jsonl eye_dialogue_log.jsonl eye_investigation_log.jsonl audit_trail.json

More That Sets Eye Apart

Beyond the headline features, Eye is built with the details that matter when a real investigation is on the line.

Cross-source corroboration

Eye never reports a single artifact in isolation — it cross-references Amcache, Prefetch, MFT, Registry and more, and rests its conclusion on where they agree, stay silent, or conflict.

Strict token budgeting

A strict token economy splits Eye's limited "memory" across the system prompt, RAG knowledge, history, and tools — so the evidence and instructions that matter are never starved.

Smart result handling

Query a million rows and Eye won't choke — over 1,000 rows it sends the model a statistical summary plus samples (TOON compression) while you keep the full table in the viewer.

Intent-aware targeting

An intent engine reads your question and pulls the right artifacts and knowledge before the model even runs — so answers stay focused on the forensic goal.

Quota-aware failover

Hit a rate limit or quota and Eye keeps going — it offers alternative models to resume the session instantly, and pools backend connections to keep requests fast.

Import existing reports

Already have forensic HTML reports? Eye parses them back into the Living Report Workspace — tables, charts and all — so prior work folds into the case.

Secure by default

API keys live in the OS keychain (never in files); file access is path-traversal protected and web fetches are SSRF-whitelisted to trusted forensic domains.

One-click triage

Open a case and Eye can auto-build a Master Forensic Triage Report — charts, tables and a baseline narrative — under the GEP, before you ask a single question.

Surfacing the Undetected — Eye × the Correlation Engine

Sophisticated intrusions and APT campaigns rarely live in a single artifact. They hide in the relationships between them — a logon here, an execution there, a file touched minutes later. That's exactly what Crow-Eye's Correlation Engine exists to find.

Eye drives correlation

Eye queries the engine directly — by time window, by identity (user / process / file), and for case-wide statistics — chaining anchors across Feathers to reconstruct a multi-stage attack timeline.

It writes new Wings

When Eye spots a recurring pattern, it can author a new Wing or Semantic Mapping — capturing the correlation so it speeds every future case. Each authored rule is evidence-linked and Eye-stamped under the GEP.

Reveals the low-and-slow

Signature and single-artifact tools miss the quiet, patient tradecraft of APTs. Behavioral, cross-artifact correlation helps surface the activity that was designed to stay undetected — for a human analyst to confirm.

AI vs AI — Turning the Attacker's Tool Against Them

Adversaries already use AI to scale phishing, generate malware, and obfuscate their tracks. Eye puts that same power on the defender's side — reasoning over sealed, evidence-linked data, cross-referencing binaries against live living-off-the-land intelligence (LOLBAS, LOLDrivers, LOFL, and malicious bootloaders), and correlating behavior to help analysts catch novel and AI-accelerated intrusions faster. The human stays in command — Eye is an assistant, not a replacement.

Forensics for Everyone — Independent Research & Privacy Accountability

Powerful forensics shouldn't be locked behind enterprise licenses. Crow-Eye and Eye AI are free and open-source (GPL-3.0) and run fully offline — so any researcher, academic, or privacy advocate can investigate what software actually does on a system. Use it to verify undisclosed telemetry, hidden data collection, or covert persistence, document it with court-grade evidence, and help hold software accountable to the people who run it.

Eye AI — Frequently Asked Questions

The quick answers investigators ask most about Crow-Eye's AI forensics assistant.

What is Eye AI?

Eye AI ("The Eye") is Crow-Eye's forensics AI assistant. It lets investigators query and analyze Windows forensic artifacts in plain language, then writes an evidence-linked report — acting as a powerful assistant to a human analyst, not a replacement.

Can Eye AI run offline / air-gapped?

Yes. Eye is model-agnostic: run it on a fully offline local AI server (Ollama or LM Studio) or a terminal CLI agent, so sensitive evidence never leaves your network.

Which AI models does Eye support?

Cloud models (OpenAI, Anthropic Claude, Google Gemini), local servers (Ollama, LM Studio), and AI command-line agents you already use (Claude Code, Gemini CLI, ChatGPT CLI, Llama.cpp, and more) — switchable mid-investigation.

Is Eye AI free and open-source?

Yes — Crow-Eye and Eye AI are free and open-source under GPL-3.0, available to any researcher or investigator.

How is it different from a chatbot on logs?

Eye is built to be court-defensible: every payload is sealed (SHA-256, hash-chained), every claim ties to a real database record, it refuses to silently drop evidence, and it surfaces a full compliance and chain-of-custody trail — not unverifiable answers.

What is the Ghassan Elsman Protocol?

The GEP is Eye's forensic standard, enforced in code: answers must be chronological, specific, evidence-linked, and cross-source corroborated, and any rule Eye authors must carry a reason and evidence reference — so its output is admissible by construction.

Consult the Eye

Bring AI-powered forensics to your investigations. Download Crow-Eye and put The Eye to work.

Download Crow-Eye