# ===========================================================================
# Forensics MCP Server - .gitignore
# ===========================================================================

# --- Python virtual environment (recreated by install.ps1) ---
venv/
env/
.venv/

# --- Python build/cache ---
__pycache__/
*.py[cod]
*.egg-info/
.pytest_cache/
build/
dist/

# --- Runtime output, logs, state (regenerated at runtime) ---
forensic_output/
*.log
stderr.log
prepared_images_registry.json
extraction_registry.json

# ===========================================================================
# Third-party forensic binaries - NOT redistributed here.
# KAPE, Eric Zimmerman tools, Arsenal Image Mounter, SleuthKit, Volatility3,
# UnifiedLogReader, chainbreaker, mac_apt each have their own licenses and
# download terms. Users must obtain them and place them under Tools/ (see
# README "Obtaining the external tools"). Do NOT commit them to a public repo.
# ===========================================================================
Tools/

# --- Forensic evidence / images / samples (never commit real evidence) ---
Testing_Data/
Samples/
*.E01
*.Ex01
*.s01
*.dd
*.raw
*.001
*.002
*.aff
*.aff4
*.vmem
*.vmdk
*.vhd
*.vhdx
*.dmg
*.img
*.mem
*.hve
*.pf
*.evtx
*.keychain
*.keychain-db

# --- Secrets / local config ---
.env
config/local.yaml

# --- Local-only docs (not published) ---
CLAUDE.md

# --- OS / IDE noise ---
.DS_Store
Thumbs.db
.vscode/
.idea/
*.swp
