KRAKADYL

# KRAKADYL — Investigations Should Never Lose Their Memory ### Reported is not verified. **47 missing screws. 57,000 messages. One forgotten server. 167 lives lost on an oil platform.** These are not fictional scenarios. They are details from real disasters, failed investigations, and operational breakdowns. And they raise a question that matters far beyond digital forensics: **What happens when people act on information that nobody actually verified?** That's why I built KRAKADYL. Not another chatbot. Not another tool that produces impressive answers. **A system designed to protect the investigation before the answer is ever reached.** ### The failures were real. So were the consequences. **1991. Continental Express Flight 2574.** During maintenance, screws were removed from the horizontal stabilizer. Critical information about unfinished work failed to reach the next shift. The aircraft flew with 47 screws missing. Fourteen people died. **1988. Piper Alpha.** A safety valve had been removed from a pump. Two work permits covered related work, but they did not reference each other. The control room knew about the pump repair, not the missing valve. The pump was restarted. 167 people died. **2017. The Liam Allan case.** A police officer believed he had reviewed a download containing more than 57,000 messages. He had not completed the review. The prosecution relied on that assurance. Messages relevant to the defense were already in the collected evidence. The prosecution collapsed. **2012. Knight Capital.** New software was deployed to seven of eight servers. The eighth retained outdated code. No independent review caught the incomplete deployment. In approximately 45 minutes, the firm lost more than $460 million. Four different events. Four different chains of causation. But a recurring pattern emerges: **Something was unfinished, unverified, disconnected, or unknown to the next person who needed it.** No software can credibly claim it would have prevented these events. But they expose a problem that deserves to be taken seriously. ### The most dangerous mistake can be an ordinary assumption. Imagine three investigators working on the same case. One collects evidence. Another assumes it was verified. A third resumes the investigation days later, trusting the record left behind. But a critical collection window has closed. An observation remains unverified. An authorization has expired. Nobody necessarily lied. Nobody necessarily intended to make a mistake. They were tired, interrupted, working under pressure, or relying on someone else's understanding of the case. **The investigation continued. The evidence did not.** And when the final analysis begins, even the best tools cannot recover information that was never preserved. This is the gap KRAKADYL addresses. ### I built it because I needed it. I'm Anna Tchijova, an independent security researcher and developer. I already build digital forensic and incident response systems. I know how much effort goes into collecting, examining, and analyzing evidence. But I needed something else. I needed to know what had actually been collected. What was still missing. Which findings were independently verified. Which assumptions were unresolved. Who was responsible for the next action. Whether that person still had the authority to perform it. And I needed that information to survive interruptions, changes of investigator, and the passage of time. Because I don't work exclusively on digital forensics. I also conduct research, investigate complex technical problems, and work across disciplines. I want to support investigations that involve multiple people, conflicting findings, evolving hypotheses, and long periods between sessions. Scientific research. Investigative journalism. Cybersecurity. AI safety. Collaborative investigations. Different disciplines, but related questions about evidence, provenance, responsibility, and continuity. **I didn't invent a problem to justify an AI application. I built an application because I already had the problem.** ### Meet KRAKADYL. **The crocodile that doesn't let go of the evidence.** KRAKADYL is an AI-assisted investigation system built to preserve evidence state, investigative continuity, verification requirements, and authorization boundaries. Meta's **Muse Spark** helps reason about the case, organize information, and propose investigative actions. Meta's **SAM 3.1** brings visual segmentation into evidence examination. Muse Spark performed well in its assigned role: reasoning, organizing, and proposing. KRAKADYL combines these capabilities with a deterministic investigation engine that evaluates the conditions under which an action can proceed. **The AI proposes. The engine checks. Humans verify. The investigation remembers.** This is not about making AI less capable. It's about making capable AI useful inside an investigative process where responsibility, evidence, and authority must remain explicit. ### What does that actually look like? Consider a forensic investigation involving two devices. **Device A is within the mandate. Device B is not.** KRAKADYL doesn't silently include Device B simply because its contents might be useful. Now consider a clock-related evidence requirement. The available information is insufficient to establish the required conclusion. **KRAKADYL returns `gather_evidence`.** It doesn't invent certainty to make the workflow look successful. Now change the conditions again. Alter an evidence file. Revoke the mandate before execution. **The action is refused, and the decision is recorded.** These behaviors are exercised in reproducible cases, with actual application logic and documented tests. KRAKADYL also supports handoffs between investigators and bounded delegation, so responsibility can change without silently transferring unlimited authority. **The point isn't to make every investigation reach a conclusion.** **It's to make sure the investigation knows what supports that conclusion — and what doesn't.** ### Research wasn't an afterthought. Before presenting KRAKADYL as a solution, I investigated whether the underlying problem was real, how other disciplines had addressed it, and what existing systems already provided. The resulting international research examines aviation, medicine, industrial safety, criminal justice, cybersecurity, investigative workflows, agent authorization, and evidence provenance. It identifies prior work, compares approaches, documents limitations, and distinguishes established findings from hypotheses that still require testing. I did not find a defensible global statistic for how many digital investigations fail because of avoidable coordination or verification problems. **So I didn't invent one.** The historical evidence supports the existence and significance of these failure patterns. It does not establish that KRAKADYL has already reduced them in real-world deployments. That distinction matters. ### I didn't just test whether it worked. I tried to break it. I conducted documented red-team campaigns within stated threat models. I attacked verification logic, authorization boundaries, concurrent operations, delegation, evidence integrity, and collaborative workflows. Some attacks exposed genuine defects. I reproduced them, corrected them, and added regression tests. Others failed to break the tested guarantees. The reports document both outcomes. The public repository contains the implementation, research, technical documentation, adversarial findings, corrections, regression tests, and known limitations. **I wanted a project that could be examined, challenged, and improved — not one that depended on a convincing presentation.** ### The first use case is forensic. The underlying questions extend beyond it. KRAKADYL begins with digital forensics because that's a domain I know, and one where failures can be demonstrated through concrete, falsifiable scenarios. But consider the questions that motivated it. How does a scientific team preserve the history of a disputed finding? How does a journalist distinguish a source's statement from independently verified information? How does an investigation continue when its original investigator is unavailable? How can people collaborate with AI without losing track of who observed, proposed, verified, authorized, or executed something? These are directions I intend to explore, not claims of completed validation across every discipline. The ambition is to build a flexible environment for evidence-driven work, where individuals and teams can investigate without losing the context that gives their findings meaning. ### The hackathon ends. KRAKADYL doesn't. This submission represents a working, research-driven stage of a continuing project. I will keep developing it after the competition. I want to improve the investigative experience, expand collaborative workflows, integrate additional tools, strengthen security boundaries and operational guarantees, and test KRAKADYL in more demanding settings. I also intend to keep attacking it. Because a failed test can reveal something important. A corrected defect can become a regression test. And a documented limitation is more useful than a guarantee nobody can defend. My goal is not a system that claims to know everything. It's a system that helps investigators know exactly where they stand. What they have. What they're missing. What they can trust. What they still need to verify. And what the next person needs to know. **A system that remembers what humans should not have to carry in their heads.** **KRAKADYL is not the end of an investigation. It is what helps an investigation survive everything that happens along the way.** --- ### How deep do you want to go? You don't need to take my word for any of this. **Start with the experience.** [Explore the KRAKADYL website](https://krakadyl-live.vercel.app/) — presentations, demonstrations, research, and additional audiovisual material. **See the project.** [Read the GitHub README](https://github.com/annatchijova/krakadyl) — the problem, the interface, the architecture, and the implemented workflows. **Examine the engineering.** [Open the Technical README](https://github.com/annatchijova/krakadyl/blob/main/TECHNICAL_README.md) — the mechanisms, contracts, implementation details, and documented boundaries. **Challenge the claims.** [Read the known limitations](https://github.com/annatchijova/krakadyl/blob/main/docs/known-limitations.md) — what is implemented, what remains unresolved, and what has not yet been demonstrated. **Follow the research.** [Read the international research report](https://github.com/annatchijova/krakadyl/blob/main/KRAKADYL%20GLOBAL%20RESEARCH%20EN.md) — documented incidents, scientific literature, existing approaches, and the evidence behind the problem. **Examine the attacks.** [Explore the red-team reports](https://github.com/annatchijova/krakadyl/tree/main/docs) — reproduced failures, fixes, regression tests, and residual risks. **Test the system.** [Run KRAKADYL yourself](https://github.com/annatchijova/krakadyl/blob/main/frontend/README.md) — configure the backend, frontend, and operator credentials. **Or try to break it. I did.** ### KRAKADYL **Reported is not verified.** **Forensics is where KRAKADYL begins. Not where it ends.**