An autonomous DFIR agent that hunts timestomping and rename/move laundering on the SANS SIFT Workstation, driven by Claude Code, with a read-only architecture and self-correcting triage loop using the…