 # scan 2MB after carved PE for MZ/PK
 start=347791360+57344
 with open(PATH,"rb") as f:
     f.seek(start)
     chunk=f.read(2*1024*1024)
 print("after PE first 16", chunk[:16].hex(), repr(chunk[:16]))
 # MZ with PE
 hits=[]
 i=0
 while True:
     j=chunk.find(b"MZ", i)
     if j<0: break
     if j+0x40 < len(chunk):
         e=struct.unpack_from("<I", chunk, j+0x3c)[0]
         if 0x40 <= e < 0x400 and j+e+4<=len(chunk) and chunk[j+e:j+e+4]==b"PE\x00\x00":
             machine,nsec,td=struct.unpack_from("<HHI", chunk, j+e+4)
             hits.append((start+j, hex(machine), nsec, td))
     i=j+1
     if len(hits)>10: break
 print("PE after sample:", hits)
 # PK
 pk=[]
 i=0
 while True:
     j=chunk.find(b"PK\x03\x04", i)
     if j<0: break
     pk.append(start+j)
     i=j+1
     if len(pk)>8: break
 print("ZIP after sample:", pk)

 # also 2MB BEFORE
 with open(PATH,"rb") as f:
     f.seek(347791360-2*1024*1024)
     chunk=f.read(2*1024*1024)
 hits=[]
 i=0
 while True:
     j=chunk.find(b"MZ", i)
     if j<0: break
     if j+0x40 < len(chunk):
         e=struct.unpack_from("<I", chunk, j+0x3c)[0]
         if 0x40 <= e < 0x400 and j+e+4<=len(chunk) and chunk[j+e:j+e+4]==b"PE\x00\x00":
             machine,nsec,td=struct.unpack_from("<HHI", chunk, j+e+4)
             hits.append((347791360-2*1024*1024+j, hex(machine), nsec, td))
     i=j+1
     if len(hits)>10: break
 print("PE before sample:", hits)

 # look at work carved PEs
 import glob
 print("\ncarved files:")
 for g in glob.glob("work/**/*", recursive=True):
     if os.path.isfile(g) and os.path.getsize(g)>100:
         print(f"  {g} {os.path.getsize(g)}")
 PY (timeout 20s)

 Operation aborted

 Took 0.0s



 inbox
 This operation was aborted


 Error: This operation was aborted

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
The swarm is finished: done/SWARM_DONE exists (All definition-of-done checks pass: work/report.md (202 lines, 6
headings), work/timeline.md (37 rows), ledger has 25+ events, critic sign-off posted (#45 by s183905), check_inputs
verified, inputs unchanged. The swarm has completed the investigation.). Call done now and stop.
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
~/DFIR/SampleCases/AliHadi-swarm/s1839 • s183903
↑1.1M ↓12k R162k $2.286 21.4%/500k (auto)                                              (azure-foundry) grok-4.6 • medium
swarm:s183903
To resume this session: pi --session-dir /Users/halilozturkci/DFIR/SampleCases/AliHadi-swarm/s1839/.pi-sessions/s183903
--session 01a0b693-7de8-76b6-b3d1-8ff7f58f65e5
    ~/DF/Sa/AliHadi-s/s1839                                                    ✔  took 24m 21s   at 01:36:15 
