# ---------------------------------------------------------------
# Raw forensic artefacts: property of University of Westminster,
# excluded from public GitHub mirror per ethics scope
# (ETH2526-2077). Retained locally for submission and viva only.
# ---------------------------------------------------------------

# Prefetch (.pf binaries)
scenarios/*/artefacts/prefetch/**
scenarios/*/run_*/artefacts/prefetch/**

# Event log binaries (.evtx)
scenarios/*/artefacts/event_logs/**
scenarios/*/run_*/artefacts/event_logs/**

# Registry hive binaries (NTUSER.DAT, UsrClass.dat, transaction logs)
scenarios/*/artefacts/shellbags/**
scenarios/*/run_*/artefacts/shellbags/**

# System hives (SYSTEM, SOFTWARE, Amcache.hve)
scenarios/*/artefacts/supporting/**
scenarios/*/run_*/artefacts/supporting/**

# Explicit allow: chain-of-custody manifest per scenario
!scenarios/*/artefacts/supporting/acquisition_manifest.csv
!scenarios/*/run_*/artefacts/supporting/acquisition_manifest.csv

# Explicit allow: USB identity for Scenario 4
!scenarios/*/evaluation/usb_identity.txt

# ---------------------------------------------------------------
# Standard noise
# ---------------------------------------------------------------
__pycache__/
*.pyc
.DS_Store
Thumbs.db
*.swp
.vscode/
.idea/
