Skip to main content

Exhume Agent

In progress•This module is a research project, not ready to use yet

Exhume Agent dependencies and current support

exhume_agent is an embeddable autonomous forensic-assistant runtime with a terminal interface. It accepts either a disk image or an extracted folder, builds or opens a local Exhume SQLite index, and gives its configured language model evidence-grounded investigation tools.

Current capabilities​

  • disk-image and extracted-folder investigations;
  • partition, LVM, filesystem, indexer, and artefact workflows through Exhume;
  • OpenAI, Ollama, and Copilot model-provider configuration;
  • persistent sessions and local SQLite case state;
  • specialist agents, evidence queries, and report-oriented workflows;
  • an optional policy-gated host shell tool.

Build from the Exhume workspace​

cargo build -p exhume_agent
cargo run -p exhume_agent -- --help

The CLI requires either --image <PATH> or --folder <PATH>. Provider, model, endpoint, and database-path settings can be supplied as command-line options or through the corresponding environment variables shown by --help.

The agent and its tool policies are under active development. Validate all findings against the underlying evidence and parser output.