> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# How It Works

> Processing pipeline inside accdu_inspector.

1. **Extracts all streams** from Access files, including hidden `MSysObjects` and `MSysAccessStorage`.
2. **Scans for VBA markers** (`VBAPROJECT`, `dir`, `CMG=`, etc.) — even when obfuscated or stored as UTF-16.
3. **Carves embedded data** through four layers:
   * Signature-based (MZ, OLE, ZIP, PDF, PNG, RAR, 7Z, etc.)
   * High-entropy windows (detects compressed or encrypted blobs)
   * HEX ASCII runs (merged, no fragmentation)
   * UTF-16 HEX runs (merged)
4. **Runs YARA** (if provided) on all carved and decompressed content.
5. **Exports** structured reports, strings, and binary evidence.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.