Evidence arrives as one opaque blob — a multi-gigabyte encrypted archive of nested archives holding logs, CSVs, JSON, and infostealer credential dumps in a dozen inconsistent formats. Structure is unknown until you open it, untrusted archives carry path-traversal and zip-bomb payloads aimed at the extractor itself, and any all-or-nothing pipeline throws away thousands of good records the moment one member is malformed.

I split the system by language strength: a Go API for presigned direct-to-MinIO uploads, RBAC, and aggregation queries, and a Python worker for detection, recursive extraction, and parsing. Path-traversal and expansion-ratio guards live in the base extractor so every archive format inherits them, a parser registry routes each member with a text fallback so nothing silently fails, and passwords are hashed at the exact function that recognises them — no plaintext credential ever reaches the database, the index, or the UI.

Results

• 10 GB uploads via presigned PUT straight to object storage — the API only handles two small JSON calls, so upload size became a database setting instead of a server-tuning problem.
• Recursive ZIP/RAR/7Z/TAR extraction hardened against traversal, absolute and drive paths, and zip bombs by file-count, byte, and expansion-ratio ceilings, with encrypted archives parked as a first-class PASSWORD_REQUIRED state.
• Partial success by design: child parse failures are recorded and skipped while the job continues, records batch-load 1,000 at a time into PostgreSQL with OpenSearch as a rebuildable projection, and a search-index outage degrades search without ever failing a job.