Triage Databases v2025.02

Pre-built Triage Databases

Download these instead of building from source (saves 6-8+ hours).

Contents

Database	Size	Compressed	Contents
known_good.db	5.6 GB	1.1 GB	2.7M file paths, 8M hashes, 254 OS versions
context.db	2.4 MB	567 KB	227 LOLBins, 1983 drivers, 2286 DLLs, 57 process rules

Quick Install

cd forensic-triage-mcp
./scripts/download-databases.sh

Or manually:

curl -LO <asset-url>/known_good.db.zst
curl -LO <asset-url>/context.db.zst
zstd -d known_good.db.zst -o data/known_good.db
zstd -d context.db.zst -o data/context.db

Staying Current

After initial download, use incremental updates:

python scripts/update_sources.py --pull

Data Sources

• VanillaWindowsReference (file baselines)
• LOLBAS (LOLBins)
• LOLDrivers (vulnerable drivers)
• HijackLibs (DLL hijacking)
• MemProcFS (process expectations)