# PFES-ENG-008 — Evidence Extraction

**Status:** Mature architectural principle  
**Knowledge Cycle Stages:** Observe

## Purpose

Produce reusable observations independently of current interpretation.

## Engineering Problem

Coupling extraction to a single hypothesis causes expensive repeated analysis every time engineering understanding changes.

## Historical Engineering Evolution

Project Frankenstein originally answered questions directly from disassembly. As the corpus expanded across hundreds of payloads, repeated investigations recollected the same observations. Stage 5B emerged to separate evidence from interpretation.

## Engineering Discoveries

- Separating evidence extraction from interpretation dramatically accelerated analyzer evolution.
- Evidence remains valuable when theories change.

## Architectural Decisions

- Evidence is a first-class artifact.
- Preserve uncertainty.
- Favor generalized extraction over one-off conclusions.

## Knowledge Produced

- Strings
- Command comparisons
- Call relationships
- Hardware constants
- Structural observations
- Negative search results

## Knowledge Consumed

- Representations
- Topology
- Architecture models

## Current Engineering State

Stage 5B is the current HLDS evidence-extraction implementation. It produces inventories and findings used by many later analyses. Runs are expensive, so unnecessary reruns should be avoided.

## Engineering Lessons

- Collect evidence once and interpret it many times.
- Negative results are knowledge when scope and method are recorded.

## Negative Knowledge

Project Frankenstein no longer assumes:

- Every engineering question requires a fresh scan.
- Uncertain findings should be discarded.

## Current Implementations

- hlds_stage5b_analyzer.py
- Stage 5B inventories and findings stores

## Future Implementations

- Platform-independent evidence schema
- More efficient incremental extraction
- Better indirect/table-driven command detection

## Open Questions

To be expanded during engineering review.

## Why This Chapter Exists

Evidence extraction prevents the project from repeatedly paying the cost of observation.
