DFIR Workbench

Host/network timelines, file artefacts, and evidence export. Browser/memory collectors remain adapter contracts only.