Code Repositories
Traces collects entire source code repositories, including every branch and the full commit history behind them. Not a snapshot of what the code looks like today, but the record of how it got that way — who wrote what, when, and what was there before.
Collection runs through GitHub's and Bitbucket's own APIs. Nothing is installed on your client's machines and nothing changes in their account.
What is collected?
As standard, for each repository in scope:
Every file, and every version of every file, across every branch
The complete commit history, including commits no longer on any branch
Commit metadata — author, committer, timestamps, and messages
The working tree at every commit, so any file* can be recovered as it stood at any point
We can also collect, at your request:
Pull requests and merge requests, with their comments and review history
Issues and issue comments
Repository settings and collaborator lists
Fork and clone relationships
* A note on deleted history. Git is unusually good at holding onto things — a deleted branch or an amended commit is often still recoverable. But if history has been rewritten and the old commits have since been garbage collected by the platform, they are gone, and nobody can produce them. We will tell you what we found and what we couldn't, and the chain of custody records both.
What do you need from me?
Someone with owner or admin rights on the GitHub organisation or Bitbucket workspace. We send them a link to install the Traces app, which shows exactly what it is asking for before they approve anything.
The access is read-only. Traces cannot push, cannot change settings, and cannot delete anything. It can be removed at any point and we include instructions for doing so in the email.
We know that granting anyone access to a codebase is a bigger ask than granting access to a mailbox. Source code is usually the most valuable thing a software business owns, and handing over read access to it — even to a forensic firm — is not a small decision. The best approaches we have to mitigating this risk are a) access can be scoped to named repositories rather than the whole organisation, so nothing outside the matter is reachable. And b) the chain of custody records every repository accessed, what was taken, and when.
If even scoped access is too broad, there is a manual route — your client produces a full mirror clone themselves and sends it to us. It works, and we'll provide the exact commands. But the collection is then only as good as their execution of it, and that is a weaker position to be in if anyone challenges it later. If this is the approach you think we need, we can discuss further on the scoping call.
What do I get back?
Your evidence
A full mirror of each repository, exactly as it stood at the point of collection. It can be opened with standard Git tooling, which means anyone — including the other side — can check out any commit, view any file at any point in its history, and see the same thing we saw. Where you have asked for pull requests, issues or settings, those come as JSON alongside.
Chain of custody
How the collection was performed, who instructed us, what authorisation was granted, and which repositories were in scope — with anything we couldn't reach recorded in the table. The point of it is repeatability. Someone following the same steps, at the same time, would have collected the same data.
Hash list
A hash is a mathematical signature of a file. It looks at the contents and derives a long number that is unique to that exact file in that exact state. If an exhibit is challenged later, the hash proves the file is the same one we collected. A CSV, openable in Excel.
Item manifest
A readable CSV covering every commit collected, so you don't have to drive Git to answer basic questions. Columns include the repository, branch, commit hash, author name and email, committer name and email, authored and committed timestamps, the commit message, and the files changed.
Collections are delivered as a password-protected ZIP. Your analyst sends the password separately and we don't publish how (security stuff). The download link works once; ask and we'll issue another.
Our own records of the engagement - who instructed us, what we were asked to do, what we did - is retained for six years. Traces will hold a copy of the ZIP for 90 days once we have confirmed you have downloaded and can access the bundle. You can at any time request the deletion of your collection from Traces.