Black Box
A tamper-evident activity recorder for your Windows machine.
Black Box is a forensic-grade activity recorder for Windows. It runs as a quiet system service, captures every USB connection, file open, login event, process start with its full command line, PowerShell execution via Windows ETW, critical registry key changes, and browser window titles — all written into a SHA-256 hash chain that is mathematically tamper-evident. When your device leaves your hands, you get back a verifiable record of what happened.
SESSION
A3F2-9C1A-4F0B
EVENTS
1,284
INTEGRITY
100%
ENCRYPT.
AES-256
WATCHDOG
ACTIVE
USB DEVICES OBSERVED
2 unique drives
BYTES MOVED
5.0 GB
HASH CHAIN . SHA-256
6 of 1,284 blocks
WATCHDOG . ACTIVE
Self-healing monitor
UPTIME 31d 04h 12m
RESTARTS 0
UPTIME 31d 04h 12m
RESTARTS 0
UPTIME 12h 45m
RESTARTS 1
UPTIME 31d 04h 11m
RESTARTS 0
[14:31:08] WATCHDOG_RESTART_LOGGED
USB Watcher process_id=4892 stopped unexpectedly
elapsed_until_restart_ms=4720
action=process_relaunched verify=ok
chain_entry_written hash=8a02f1 prev=c54bd7
integrity_unbroken
FORENSIC REPORT . SIGNED PDF
Session A3F2-9C1A-4F0B
EVENTS
1,284
DURATION
47 min
INTEGRITY
100%
# report.pdf — manifest excerpt
session_id A3F2-9C1A-4F0B
chain_root 0xb24a91...e8d2
events 1284 (CRIT 1, HIGH 2, INFO 1281)
integrity sha256_chain unbroken
watchdog 1 restart logged inline
shadow_copy aes-256-gcm verified
signature pkcs7_signed_data ok
verify offline: blackbox-verify report.pdf
Under the hood.
The cryptographic primitives forensic teams already trust.
Black Box is built on industry-standard primitives, not novel cryptography. The SHA-256 hash chain, the AES-256-GCM shadow copy, the PBKDF2 PIN derivation. Standard parts assembled into a tamper-evident whole.
- +Windows Service (BlackBoxSvc, low-privilege account)
- +Event Tracing for Windows (ETW) at kernel level
- +AES-256-CBC / GCM encrypted shadow copy
- +PBKDF2 PIN derivation
- +SHA-256 hash chain with anchor files
Tampering is mathematically forced to leave a mark.
The hash chain means an attacker cannot edit one entry without rewriting every subsequent one. The shadow copy means the attacker cannot quietly delete the primary log. The watchdog means killing the service is itself a logged event. Three independent ways every interference produces evidence.
- +Hash chain breaks visibly if any row is altered
- +Shadow copy survives primary-log deletion
- +Watchdog restarts and logs the interruption
- +Anchor files cross-validate independently
A laptop sent for repair, with proof of what happened.
You install Black Box, hand the laptop to the service centre, and pick it up two days later. You generate the forensic report and see: one technician login, four file opens (all in the diagnostic folder), no USB devices attached, no new processes. You have proof that nothing else happened. If the report had instead shown a USB stick arriving and the user-photos folder being read, you would have evidence the law cares about.
Black.
Open the site.
Free for individuals, forever. The 2.9 MB installer ships signed, runs offline, and produces verifiable evidence on day one.