Inspector is a local-first Windows investigation tool for short-lived processes. It captures command lines, parent chains, hashes and process lifetimes through Sysmon, correlates persistence, and turns the evidence into an interactive HTML report. No cloud. No telemetry. Open source.