Start an investigation

1. Choose New investigation in the sidebar. Lysis asks What would you like to take apart?: Software, Firmware, A device I can connect to, A circuit board or How an app talks. Something else lets you describe it in your own words.
2. Pick one and the page turns. For software or firmware, drag the apps, files or folders onto the panel, or choose Browse…. A device, board or traffic start asks one plain question first, such as how the device connects (USB cable, Serial or UART adapter, Network or Wi‑Fi, Bluetooth, Just a model number).
3. Press Next, say what you want to find out (for example How it works, Security weaknesses or Where to change it) and add a note if you like.
4. Press Start investigation. Lysis creates the investigation, adds your targets and sends the first message for you. The agent starts REA, opens an analysis session and reports which analysis engines are ready. The investigation takes its name from that first thread, the same way Synoec names threads; double-click its name to rename it.

Nothing is created until you press Start investigation, so backing out leaves no empty investigation behind.

A new thread in an existing investigation shows next steps instead: the suggestions your recent threads ended with (From your recent threads), a Build on this link for each, and the usual next moves for how far the investigation has come.

To remove an investigation, open its actions (…) and choose Remove investigation…. Its targets, evidence, notes and threads stay on disk.

The first time you open Lysis after launching the app, its mark splits apart into the investigation graph. It plays once per launch.

The sidebar, headed Lysis | Hackathon, lists your investigations, each with its threads (Show more after the first few). Click an investigation’s name to collapse or expand it; hover it for New thread (+) and its actions (…). Usage sits at the top beside New investigation. The workbench panel works as it does in Synoec.