A local investigation workspace for forensic data
pink-lemonade is a local desktop workspace for the part of a forensic investigation that happens after parsing.
Bring it CSV, TSV, Excel, JSONL/NDJSON logs, or IIS/W3C output from your forensic tools. Filter and pivot large timelines, transform text, enrich indicators, hunt across sources, and review AI-assisted findings.
pink-lemonade does not acquire evidence or generally parse raw forensic artifacts. It imports and normalizes supported tabular and log formats, then handles cleanup, pivoting, triage, enrichment, and reporting.
Work the case in one place, with each finding linked to the evidence that supports it.
Windows only. Download the portable .exe from Releases and double-click it — nothing to install. The build is unsigned, so SmartScreen asks you to confirm with More info → Run anyway the first time.
Then Import evidence… to open a timeline, or New notepad to transform text. The user guide covers the rest.
Notepad — chain small text tools: Base64/hex, IOC extraction, defang/refang, dedupe, cleanup, and CQL/KQL/SPL query builders. Each step feeds the next, live.
Data — a grid for large timelines: source tabs, split view, typed filters, column summaries, pivot tables, read-only SQL, time pivots, and row tagging.
Case — review findings recorded by you or your AI agent, inspect their evidence, track systems and indicators, and build the report.
Intel — enrichment and hunting: MaxMind GeoIP, VirusTotal, and your own watchlists, plus a sweep that finds every row an indicator appears in.
Sources import into SQLite, and database work runs in a worker instead of on the interface thread. Each open case has its own query queue, although concurrent workspaces still share the machine's disk, CPU, and memory.
Type user:alice status!=404 time>=2026-06-01 in the query bar to create filter chips; = equals, : contains, and != excludes. Right-click a timestamp to pivot around it, and tag rows Malicious / Suspicious / Unknown / Benign as you triage. Tags, sightings, and findings persist in the workspace file.
AI-assisted findings still require analyst review.
The app hosts a local MCP server that your AI agent can use from a terminal. Agent-recorded findings must cite rows that the app resolves, and the Queue keeps analyst review separate from the agent's work. Report checks cover source and host coverage, review status, cited evidence for included findings, and unresolved contradictions from an independent check.
| Agent can | Requires your approval | Analyst only |
|---|---|---|
| Search and correlate sources | Import evidence | Clear entities |
| Record evidence-backed findings | Tag rows | Approve or reject findings |
| Track leads, IOCs, and entities | Attribute sources to hosts | Clear entities and finalize reports |
| Read cached intel | Run fresh enrichment lookups |
The AI guide explains the Case workflow, evidence checks, and independent verification.
Your evidence lives in local files on your machine — workspaces, tags, watchlists, and the intel cache. pink-lemonade itself makes outbound requests only for enrichment lookups you initiate, against providers you've configured. If you connect an AI agent, the agent sends the case data it reads to its model provider under your own account and configuration — pink-lemonade's MCP server binds only to 127.0.0.1 and is never exposed to your network. There is no pink-lemonade account and no pink-lemonade server.
Start with Getting started, then Exploring data and the AI guide — or browse the full user guide.
pink-lemonade is under active development and currently targets Windows. Releases are portable and unsigned. Expect breaking changes while the project is pre-1.0.
Current limitations: Intel Sweep doesn't handle IPv6, enrichment is limited to VirusTotal and MaxMind, and Claude Code is the currently documented and tested MCP client. Other compatible clients can connect to the local MCP server but do not yet have setup guides.
Electron + React + TypeScript. Requirements: Node.js 18+ and npm.
git clone https://github.com/forynsics/pink-lemonade.git
cd pink-lemonade
npm install
npm run dev # launch with hot reload
npm test # unit tests
npm run dist # package the portable Windows .exe into dist/pink-lemonade is released under the Apache License 2.0. See NOTICE.