> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Forensic analyzer for Microsoft Access databases.

`accdu_inspector` is a forensic and malware analysis tool designed to inspect Microsoft Access databases (`.accdu`, `.accdb`, `.accde`, `.accda`, or extracted ZIPs).

It reveals **hidden macros, VBA payloads, OLE streams, and binary blobs** embedded inside Access containers — even when they're hex-encoded, fragmented, or disguised in UTF-16.

> [!NOTE]
>
> **Current version:** v1.1 · [GitHub Repository](https://github.com/tasox/accdu_inspector)

## Capabilities

> [card] VBA Detection
>
> Deep marker detection tolerant to null-interleaving and Unicode obfuscation.

> [card] MS-OVBA Decompression
>
> Pure Python decompression — no native dependencies.

> [card] YARA Scanning
>
> Scans raw and carved data with your own rule sets.

> [card] Blob Carving
>
> Magic-based, entropy-based, HEX ASCII, and UTF-16 HEX carving.

> [card] Suspicion Scoring
>
> Heuristic 0–100 score based on VBA, keywords, and embedded file signatures.

> [card] Structured Reporting
>
> CSV and JSON output for SOC/IR pipelines.

## What's New in v1.1

| Enhancement | Description |
| - | - |
| **Fragmentation-Free HEX Recovery** | Nearby HEX chunks are automatically merged. |
| **UTF-16 / Null-Interleaved HEX Detection** | Detects patterns like `4D5...` common in obfuscated Access payloads. |
| **Blob De-duplication (SHA-256)** | Repeated binary data is stored only once. |
| **Tuning Flags** | Control carving thresholds, entropy sensitivity, and merging behavior. |
| **Integrated Carving Logic** | HEX, UTF-16 HEX, and high-entropy carving unified under one pipeline. |
| **Refined Scoring Engine** | Incorporates VBA presence, keyword density, and embedded file signatures. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.