dfir-unfurl[ui,lookups]