# =============================================================================
# AMBAR - Forensic Acquisition Framework
# =============================================================================

# --- THIRD-PARTY BINARIES -----------------------------------------------------
# This repository does not redistribute third-party tools: each one keeps its own
# licence and several require registration or EULA acceptance (KAPE, FTK Imager,
# DumpIt, VMware). The folder tree is not tracked either: setup-tools.bat builds
# it from its own master table, which is also the list it checks against, so the
# layout and the expected binaries cannot drift apart.
Script/Windows/Sistema/herramientas/

# --- EVIDENCE AND OUTPUT ------------------------------------------------------
# Never commit evidence. It can contain personal data, credentials or material
# from real cases. Both folders are created by the framework at run time.
Script/Evidencias/
Script/Logs/
setup-report.txt

# Forensic images and memory dumps
*.dd
*.raw
*.img
*.mem
*.dmp
*.vmem
*.vmss
*.vmsn
*.vmrs
*.bin
*.E0*
*.Ex0*
*.s01
*.aff4
*.lime
*.ad1

# Compressed evidence
*.7z
*.zip
*.tar
*.gz
*.rar

# Extracted databases
*.db
*.sqlite
*.sqlite3
*.db-wal
*.db-shm

# --- WINDOWS ------------------------------------------------------------------
Thumbs.db
desktop.ini
ehthumbs.db
$RECYCLE.BIN/
*.lnk

# --- PYTHON (Volatility 3) ----------------------------------------------------
__pycache__/
*.py[cod]
*.egg-info/
.venv/
venv/

# --- EDITORS ------------------------------------------------------------------
.vscode/
.idea/
*.swp
*~
