// ESI FORENSICS — Data Layer
// Extends ESI_DATA._default with forensics-specific datasets

(function() {
  const d = window.ESI_DATA._default;

  d.forensics = {
    kpis: {
      totalImages: 7, imaged: 6, queued: 1, inAnalysis: 3,
      storageGB: 1282, artifactsExtracted: 48420,
      analysisJobs: 8, completedAnalyses: 5, activeAnalyses: 3,
      examiners: 4, labUtilization: 78,
      reportsGenerated: 6, reportsPending: 2,
      complianceScore: 98.5, standardsCovered: 8,
      deletedFilesRecovered: 2840, antiForensicsDetected: 0,
      avgImagingTime: '02:14:00', hashVerifiedPct: 100,
    },

    artifacts: [
      { id: 'ART-001', imageId: 'FI-142', custodian: 'James Harrington', device: 'iPhone 14 Pro', type: 'iMessage', count: 4218, dateRange: '2020-01 to 2026-03', evidentiary: true, flagged: 12, exported: true, note: 'Contains 12 flagged messages re: Apex deal pricing' },
      { id: 'ART-002', imageId: 'FI-142', custodian: 'James Harrington', device: 'iPhone 14 Pro', type: 'WhatsApp', count: 1842, dateRange: '2021-06 to 2026-03', evidentiary: true, flagged: 8, exported: true, note: 'APAC consultant discussions' },
      { id: 'ART-003', imageId: 'FI-142', custodian: 'James Harrington', device: 'iPhone 14 Pro', type: 'Call Logs', count: 892, dateRange: '2022-01 to 2026-03', evidentiary: false, flagged: 0, exported: false, note: 'Standard call history' },
      { id: 'ART-004', imageId: 'FI-142', custodian: 'James Harrington', device: 'iPhone 14 Pro', type: 'Location History', count: 14200, dateRange: '2020-01 to 2026-03', evidentiary: true, flagged: 4, exported: true, note: '4 flagged visits to competitor offices Q3 2022' },
      { id: 'ART-005', imageId: 'FI-141', custodian: 'Karen Osei', device: 'iPhone 13 Pro Max', type: 'iMessage', count: 3840, dateRange: '2020-06 to 2025-12', evidentiary: true, flagged: 6, exported: true, note: 'CFO communications with board members' },
      { id: 'ART-006', imageId: 'FI-141', custodian: 'Karen Osei', device: 'iPhone 13 Pro Max', type: 'WhatsApp', count: 2140, dateRange: '2021-01 to 2025-11', evidentiary: true, flagged: 14, exported: true, note: 'APAC operations — 14 flagged re: consultant payments' },
      { id: 'ART-007', imageId: 'FI-141', custodian: 'Karen Osei', device: 'iPhone 13 Pro Max', type: 'Call Logs', count: 648, dateRange: '2022-06 to 2025-12', evidentiary: false, flagged: 0, exported: false, note: 'Standard call history' },
      { id: 'ART-008', imageId: 'FI-140', custodian: 'Marcus Pryor', device: 'MacBook Pro 16"', type: 'Browser History', count: 8420, dateRange: '2021-01 to 2026-02', evidentiary: true, flagged: 3, exported: true, note: '3 flagged searches re: document retention policies' },
      { id: 'ART-009', imageId: 'FI-140', custodian: 'Marcus Pryor', device: 'MacBook Pro 16"', type: 'Deleted Files', count: 1240, dateRange: '2023-01 to 2026-02', evidentiary: true, flagged: 18, exported: true, note: '18 recovered draft memos to board — critical' },
      { id: 'ART-010', imageId: 'FI-140', custodian: 'Marcus Pryor', device: 'MacBook Pro 16"', type: 'Keychain', count: 84, dateRange: 'n/a', evidentiary: false, flagged: 0, exported: false, note: 'Stored credentials — not exported for privilege' },
      { id: 'ART-011', imageId: 'FI-140', custodian: 'Marcus Pryor', device: 'MacBook Pro 16"', type: 'Email Cache', count: 2480, dateRange: '2024-06 to 2026-02', evidentiary: true, flagged: 2, exported: true, note: 'Local Outlook cache with offline-only drafts' },
      { id: 'ART-012', imageId: 'FI-139', custodian: 'Helen Bishop', device: 'MacBook Pro 14"', type: 'Browser History', count: 4210, dateRange: '2021-06 to 2026-01', evidentiary: false, flagged: 0, exported: false, note: 'Standard browsing' },
      { id: 'ART-013', imageId: 'FI-139', custodian: 'Helen Bishop', device: 'MacBook Pro 14"', type: 'Email Cache', count: 1840, dateRange: '2024-01 to 2026-01', evidentiary: true, flagged: 4, exported: true, note: 'Local cache includes 4 unsent drafts' },
      { id: 'ART-014', imageId: 'FI-139', custodian: 'Helen Bishop', device: 'MacBook Pro 14"', type: 'File System', count: 12400, dateRange: 'n/a', evidentiary: false, flagged: 0, exported: false, note: 'Full filesystem catalog' },
      { id: 'ART-015', imageId: 'FI-138', custodian: 'Arnav Iyer', device: 'Dell Latitude 7440', type: 'Registry', count: 420, dateRange: 'n/a', evidentiary: true, flagged: 2, exported: true, note: 'USB device connection history — 2 unregistered devices' },
      { id: 'ART-016', imageId: 'FI-138', custodian: 'Arnav Iyer', device: 'Dell Latitude 7440', type: 'Event Logs', count: 18400, dateRange: '2023-01 to 2026-03', evidentiary: true, flagged: 6, exported: true, note: '6 flagged after-hours logon events' },
      { id: 'ART-017', imageId: 'FI-138', custodian: 'Arnav Iyer', device: 'Dell Latitude 7440', type: 'Browser History', count: 6240, dateRange: '2023-06 to 2026-03', evidentiary: false, flagged: 0, exported: false, note: 'Chrome + Edge history' },
      { id: 'ART-018', imageId: 'FI-137', custodian: 'Priya Raman', device: 'iPhone 15 Pro', type: 'iMessage', count: 2840, dateRange: '2023-01 to 2026-04', evidentiary: true, flagged: 4, exported: true, note: 'Pricing discussions with competitors flagged' },
      { id: 'ART-019', imageId: 'FI-137', custodian: 'Priya Raman', device: 'iPhone 15 Pro', type: 'Slack', count: 1420, dateRange: '2023-06 to 2026-04', evidentiary: false, flagged: 0, exported: false, note: 'Slack mobile app data' },
      { id: 'ART-020', imageId: 'FI-137', custodian: 'Priya Raman', device: 'iPhone 15 Pro', type: 'Email', count: 840, dateRange: '2024-01 to 2026-04', evidentiary: false, flagged: 0, exported: false, note: 'iOS Mail app local store' },
    ],

    analysisJobs: [
      { id: 'FA-048', imageId: 'FI-142', custodian: 'James Harrington', type: 'Keyword Search', status: 'Complete', started: '2026-03-20', completed: '2026-03-22', examiner: 'R. Ozawa', hits: 284, findings: 12, priority: 'Critical', note: 'Apex + pricing + consultant — 12 hot docs in iMessage' },
      { id: 'FA-047', imageId: 'FI-140', custodian: 'Marcus Pryor', type: 'Deleted File Recovery', status: 'Complete', started: '2026-03-02', completed: '2026-03-08', examiner: 'C. Alvarez', hits: 1240, findings: 18, priority: 'Critical', note: '18 recovered board memos previously deleted' },
      { id: 'FA-046', imageId: 'FI-141', custodian: 'Karen Osei', type: 'Keyword Search', status: 'Complete', started: '2026-02-16', completed: '2026-02-18', examiner: 'R. Ozawa', hits: 142, findings: 14, priority: 'High', note: 'FCPA consultant payment references in WhatsApp' },
      { id: 'FA-045', imageId: 'FI-138', custodian: 'Arnav Iyer', type: 'Timeline Reconstruction', status: 'In Progress', started: '2026-04-10', completed: null, examiner: 'C. Alvarez', hits: null, findings: null, priority: 'High', note: 'USB device + after-hours logon correlation' },
      { id: 'FA-044', imageId: 'FI-142', custodian: 'James Harrington', type: 'Location Analysis', status: 'Complete', started: '2026-03-24', completed: '2026-03-26', examiner: 'R. Ozawa', hits: 14200, findings: 4, priority: 'Medium', note: '4 competitor office visits confirmed via GPS' },
      { id: 'FA-043', imageId: 'FI-140', custodian: 'Marcus Pryor', type: 'Anti-Forensics Detection', status: 'Complete', started: '2026-03-10', completed: '2026-03-12', examiner: 'C. Alvarez', hits: 0, findings: 0, priority: 'High', note: 'No evidence of wiping tools, encryption bypass, or steganography' },
      { id: 'FA-042', imageId: 'FI-137', custodian: 'Priya Raman', type: 'Keyword Search', status: 'In Progress', started: '2026-04-14', completed: null, examiner: 'M. Tanaka', hits: null, findings: null, priority: 'High', note: 'Pricing + competitor terms in iMessage/Slack' },
      { id: 'FA-041', imageId: 'FI-139', custodian: 'Helen Bishop', type: 'Email Cache Analysis', status: 'In Progress', started: '2026-04-16', completed: null, examiner: 'M. Tanaka', hits: null, findings: null, priority: 'Medium', note: 'Unsent draft recovery from local Outlook cache' },
    ],

    timeline: [
      { id: 'FT-001', ts: '2026-04-08 22:14', custodian: 'Arnav Iyer', device: 'Dell Latitude 7440', eventType: 'Logon', detail: 'After-hours VPN logon from Singapore IP', severity: 'warn', imageId: 'FI-138' },
      { id: 'FT-002', ts: '2026-04-08 22:18', custodian: 'Arnav Iyer', device: 'Dell Latitude 7440', eventType: 'USB Insert', detail: 'USB device SN:8842-KL connected (unregistered)', severity: 'warn', imageId: 'FI-138' },
      { id: 'FT-003', ts: '2026-04-08 22:42', custodian: 'Arnav Iyer', device: 'Dell Latitude 7440', eventType: 'File Copy', detail: '142 files copied to USB (est. 2.4 GB)', severity: 'critical', imageId: 'FI-138' },
      { id: 'FT-004', ts: '2026-04-08 23:01', custodian: 'Arnav Iyer', device: 'Dell Latitude 7440', eventType: 'USB Remove', detail: 'USB device disconnected', severity: 'warn', imageId: 'FI-138' },
      { id: 'FT-005', ts: '2026-03-14 09:22', custodian: 'Marcus Pryor', device: 'MacBook Pro 16"', eventType: 'File Delete', detail: 'Board memo "Re: Apex Pricing Strategy v3.docx" moved to Trash', severity: 'warn', imageId: 'FI-140' },
      { id: 'FT-006', ts: '2026-03-14 09:24', custodian: 'Marcus Pryor', device: 'MacBook Pro 16"', eventType: 'Trash Empty', detail: 'Trash emptied — 18 files permanently deleted', severity: 'critical', imageId: 'FI-140' },
      { id: 'FT-007', ts: '2026-02-28 14:10', custodian: 'James Harrington', device: 'iPhone 14 Pro', eventType: 'iMessage', detail: 'Message to K. Osei: "make sure the Singapore numbers..."', severity: 'info', imageId: 'FI-142' },
      { id: 'FT-008', ts: '2026-02-15 16:42', custodian: 'Karen Osei', device: 'iPhone 13 Pro Max', eventType: 'WhatsApp', detail: 'Group chat "APAC Ops": consultant fee discussion', severity: 'warn', imageId: 'FI-141' },
      { id: 'FT-009', ts: '2022-09-14 11:30', custodian: 'James Harrington', device: 'iPhone 14 Pro', eventType: 'Location', detail: 'GPS: 40.7128° N, 74.0060° W — Apex Ventures HQ', severity: 'warn', imageId: 'FI-142' },
      { id: 'FT-010', ts: '2022-10-02 10:15', custodian: 'James Harrington', device: 'iPhone 14 Pro', eventType: 'Location', detail: 'GPS: 40.7580° N, 73.9855° W — competitor meeting (confirmed)', severity: 'warn', imageId: 'FI-142' },
      { id: 'FT-011', ts: '2026-01-18 08:42', custodian: 'Priya Raman', device: 'iPhone 15 Pro', eventType: 'iMessage', detail: 'Pricing sheet shared via iMessage to unknown contact', severity: 'warn', imageId: 'FI-137' },
      { id: 'FT-012', ts: '2025-11-04 19:18', custodian: 'Helen Bishop', device: 'MacBook Pro 14"', eventType: 'Draft Created', detail: 'Unsent email draft "Re: Board concerns about..."', severity: 'info', imageId: 'FI-139' },
    ],

    labOps: {
      examiners: [
        { id: 'EX-01', name: 'R. Ozawa', org: 'Alignment Forensics', certs: ['CFCE', 'EnCE', 'GCFE'], activeJobs: 1, completedYTD: 14, utilization: 82, specialty: 'Mobile forensics', note: 'Lead mobile examiner' },
        { id: 'EX-02', name: 'C. Alvarez', org: 'Sentinel Forensics', certs: ['CFCE', 'CCE', 'GASF'], activeJobs: 1, completedYTD: 8, utilization: 74, specialty: 'Laptop / desktop forensics', note: 'Lead computer examiner' },
        { id: 'EX-03', name: 'M. Tanaka', org: 'Firm — Digital Forensics', certs: ['EnCE', 'GCFE'], activeJobs: 2, completedYTD: 12, utilization: 88, specialty: 'Email + cloud forensics', note: 'Internal forensics lead' },
        { id: 'EX-04', name: 'S. Patel', org: 'Firm — Digital Forensics', certs: ['CFCE'], activeJobs: 0, completedYTD: 6, utilization: 45, specialty: 'Database forensics', note: 'Available for new assignments' },
      ],
      tools: [
        { id: 'TL-01', name: 'Cellebrite Premium', version: '7.68', type: 'Mobile', licenseExpiry: '2026-09-30', seats: 3, inUse: 2, annualCost: 98400, status: 'Active' },
        { id: 'TL-02', name: 'Cellebrite UFED', version: '7.68', type: 'Mobile', licenseExpiry: '2026-09-30', seats: 2, inUse: 1, annualCost: 48000, status: 'Active' },
        { id: 'TL-03', name: 'EnCase Forensic', version: '23.4', type: 'Computer', licenseExpiry: '2026-12-31', seats: 4, inUse: 2, annualCost: 64000, status: 'Active' },
        { id: 'TL-04', name: 'FTK Imager', version: '4.7.1', type: 'Computer', licenseExpiry: 'Free', seats: null, inUse: 3, annualCost: 0, status: 'Active' },
        { id: 'TL-05', name: 'Axiom Cyber', version: '7.8', type: 'Cloud + Mobile', licenseExpiry: '2026-06-30', seats: 2, inUse: 1, annualCost: 42000, status: 'Active' },
        { id: 'TL-06', name: 'X-Ways Forensics', version: '20.9', type: 'Computer', licenseExpiry: '2027-01-15', seats: 2, inUse: 0, annualCost: 8400, status: 'Active' },
      ],
      queue: [
        { id: 'FQ-01', imageId: 'FI-143', custodian: 'David Okonkwo', device: 'iPhone 14', type: 'Full Imaging', priority: 'High', assignedTo: 'R. Ozawa', scheduledDate: '2026-04-23', note: 'Pending device receipt' },
        { id: 'FQ-02', imageId: null, custodian: 'Felix Wong', device: 'iPhone 13 (personal)', type: 'Consent Imaging', priority: 'Medium', assignedTo: 'R. Ozawa', scheduledDate: '2026-04-28', note: 'Awaiting custodian consent form' },
      ],
    },

    reports: [
      { id: 'FR-006', imageId: 'FI-142', custodian: 'James Harrington', title: 'Mobile Forensic Examination — iPhone 14 Pro', examiner: 'R. Ozawa', dateIssued: '2026-03-28', findings: 16, methodology: 'NIST SP 800-101 Rev. 1', daubert: true, fre702: true, courtAdmissible: true, status: 'Final', pages: 42 },
      { id: 'FR-005', imageId: 'FI-140', custodian: 'Marcus Pryor', title: 'Computer Forensic Examination — MacBook Pro 16"', examiner: 'C. Alvarez', dateIssued: '2026-03-14', findings: 18, methodology: 'NIST SP 800-86', daubert: true, fre702: true, courtAdmissible: true, status: 'Final', pages: 68 },
      { id: 'FR-004', imageId: 'FI-141', custodian: 'Karen Osei', title: 'Mobile Forensic Examination — iPhone 13 Pro Max', examiner: 'R. Ozawa', dateIssued: '2026-02-22', findings: 14, methodology: 'NIST SP 800-101 Rev. 1', daubert: true, fre702: true, courtAdmissible: true, status: 'Final', pages: 38 },
      { id: 'FR-003', imageId: 'FI-138', custodian: 'Arnav Iyer', title: 'Computer Forensic Examination — Dell Latitude 7440', examiner: 'C. Alvarez', dateIssued: null, findings: null, methodology: 'NIST SP 800-86', daubert: null, fre702: null, courtAdmissible: null, status: 'In Progress', pages: null },
      { id: 'FR-002', imageId: 'FI-139', custodian: 'Helen Bishop', title: 'Computer Forensic Examination — MacBook Pro 14"', examiner: 'M. Tanaka', dateIssued: null, findings: null, methodology: 'NIST SP 800-86', daubert: null, fre702: null, courtAdmissible: null, status: 'In Progress', pages: null },
      { id: 'FR-001', imageId: 'FI-137', custodian: 'Priya Raman', title: 'Mobile Forensic Examination — iPhone 15 Pro', examiner: 'R. Ozawa', dateIssued: '2026-04-08', findings: 4, methodology: 'NIST SP 800-101 Rev. 1', daubert: true, fre702: true, courtAdmissible: true, status: 'Final', pages: 28 },
    ],

    compliance: [
      { code: 'ISO 27037', title: 'Digital evidence — identification, collection, acquisition & preservation', coverage: 100, lastAudit: '2026-04-12', auditor: 'BSI', findings: 0 },
      { code: 'ISO 27041', title: 'Assurance for digital evidence investigative methods', coverage: 100, lastAudit: '2026-04-12', auditor: 'BSI', findings: 0 },
      { code: 'ISO 27042', title: 'Analysis and interpretation of digital evidence', coverage: 95, lastAudit: '2026-04-12', auditor: 'BSI', findings: 1 },
      { code: 'NIST 800-86', title: 'Guide to integrating forensic techniques into incident response', coverage: 100, lastAudit: '2026-04-12', auditor: 'Firm InfoSec', findings: 0 },
      { code: 'NIST 800-101', title: 'Guidelines on mobile device forensics', coverage: 100, lastAudit: '2026-04-12', auditor: 'Firm InfoSec', findings: 0 },
      { code: 'SWGDE', title: 'Scientific Working Group on Digital Evidence best practices', coverage: 100, lastAudit: '2026-04-12', auditor: 'External peer review', findings: 0 },
      { code: 'ASTM E2763', title: 'Standard practice for computer forensics', coverage: 98, lastAudit: '2026-03-28', auditor: 'External peer review', findings: 0 },
      { code: 'Daubert', title: 'Expert methodology admissibility standard', coverage: 100, lastAudit: '2026-04-12', auditor: 'Outside counsel', findings: 0 },
    ],

    audit: [
      { id: 'FAU-120', ts: '2026-04-20 09:42', actor: 'M. Tanaka', action: 'ANALYSIS_START', target: 'FA-041', detail: 'Email cache analysis started — Helen Bishop MacBook', severity: 'info', sig: 'HMAC ok' },
      { id: 'FAU-119', ts: '2026-04-18 14:22', actor: 'R. Ozawa', action: 'IMAGE_VERIFY', target: 'FI-137', detail: 'SHA-256 re-verification passed — Priya Raman iPhone', severity: 'info', sig: 'HMAC ok' },
      { id: 'FAU-118', ts: '2026-04-16 10:08', actor: 'M. Tanaka', action: 'ARTIFACT_EXPORT', target: 'ART-018', detail: 'iMessage artifacts exported for review — Priya Raman', severity: 'info', sig: 'HMAC ok' },
      { id: 'FAU-117', ts: '2026-04-14 08:15', actor: 'M. Tanaka', action: 'ANALYSIS_START', target: 'FA-042', detail: 'Keyword search started — Priya Raman iPhone', severity: 'info', sig: 'HMAC ok' },
      { id: 'FAU-116', ts: '2026-04-10 11:30', actor: 'C. Alvarez', action: 'ANALYSIS_START', target: 'FA-045', detail: 'Timeline reconstruction started — Arnav Iyer Dell', severity: 'info', sig: 'HMAC ok' },
      { id: 'FAU-115', ts: '2026-04-08 16:48', actor: 'R. Ozawa', action: 'REPORT_ISSUED', target: 'FR-001', detail: 'Final report issued — Priya Raman iPhone 15 Pro', severity: 'info', sig: 'PGP ok' },
      { id: 'FAU-114', ts: '2026-04-02 10:22', actor: 'R. Ozawa', action: 'IMAGE_COMPLETE', target: 'FI-137', detail: 'Cellebrite FFS imaging complete — 38.8 GB · SHA-256 verified', severity: 'info', sig: 'HMAC ok' },
      { id: 'FAU-113', ts: '2026-03-28 14:08', actor: 'R. Ozawa', action: 'REPORT_ISSUED', target: 'FR-006', detail: 'Final report issued — James Harrington iPhone 14 Pro', severity: 'info', sig: 'PGP ok' },
      { id: 'FAU-112', ts: '2026-03-14 09:44', actor: 'C. Alvarez', action: 'REPORT_ISSUED', target: 'FR-005', detail: 'Final report issued — Marcus Pryor MacBook Pro', severity: 'info', sig: 'PGP ok' },
      { id: 'FAU-111', ts: '2026-03-12 16:20', actor: 'C. Alvarez', action: 'ANALYSIS_COMPLETE', target: 'FA-043', detail: 'Anti-forensics scan complete — no evidence of tampering', severity: 'info', sig: 'HMAC ok' },
      { id: 'FAU-110', ts: '2026-03-08 11:14', actor: 'C. Alvarez', action: 'ANALYSIS_COMPLETE', target: 'FA-047', detail: 'Deleted file recovery complete — 1,240 files · 18 critical', severity: 'warn', sig: 'HMAC ok' },
      { id: 'FAU-109', ts: '2026-02-28 15:42', actor: 'Sentinel Forensics', action: 'IMAGE_COMPLETE', target: 'FI-138', detail: 'FTK Imager E01 + logical — Arnav Iyer Dell · 256 GB', severity: 'info', sig: 'HMAC ok' },
    ],
  };
})();