Provenance Feature

Artifact provenance currently stops at the file in LEAPP's. A report row may point to sms.db, but not to the exact record it came from. To verify a row, an examiner must reopen the database, recreate the module’s query, and find the matching record by hand.

Many modules already know the exact source while parsing. SQLite modules know the rowid. Plist and XML modules know the key path. Modules that decode blob columns may know the row, blob field, and offset. There is just nowhere to store this information in the output.

**Proposal**: add an optional source locator to each output row.

For example:
- {"table": "message", "rowid": 412} - {"keypath": "..."} - A short path such as row -> blob column -> field
This could be stored with the source file as (source_file, locator).

The locator should be optional for each row. Some results, such as joined or aggregated rows, do not have one clear source record. In those cases, leaving it out is better than adding an inaccurate locator.

Report writers could include this in TSV or structured output without changing the HTML reports. Existing modules would not need to change. Modules that opt in would become verifiable down to the source record.

If structured output already has a place for this, please point us to it.

Curious what maintainers think. This might intersect with @JamesHabben 's design proposal.

cc @abrignoni @stark4n6 @Johann-PLW