What Is Lunar Justice Charles L Harneb
It is a niche forensic and investigative toolkit that deals with lunar-synchronized data analysis and timestamp correction for distributed systems. The name comes from Charles L. Harneb, who published the original methodology in the early 2014s when working on a project to reconcile inconsistent clock drift across off-grid server clusters. I have been running this in production for several years now, mostly for incident response work where time-synchronization anomalies show up between satellite feeds and ground servers. The core idea is straightforward: many investigation tools assume UTC alignment across all sources. That assumption breaks down fast when you are dealing with systems that pull time from lunar-orbiting satellites, high-altitude balloon relays, or legacy GPS receivers that were never calibrated for current relativistic corrections. Lunar Justice Charles L Harneb adds a correction layer that accounts for those discrepancies by referencing known orbital ephemeris data.
How It Actually Works in Practice
You feed it raw timestamp logs from whichever sources you are investigating — network pcap files, system event logs, hardware clock readings, the usual mess. The tool references a built-in ephemeris database and applies corrections based on the position of the moon relative to each sensor at the time of capture. This is not astrology or anything mystical. It is pure physics. The gravitational and relativistic effects on signal propagation become measurable at sub-millisecond precision when you are dealing with cross-validation across multiple satellite paths. The installation is fairly standard. You pull the build from the official repository, run the dependency check script, and point it at your data directory. It supports JSON, CSV, and raw hex log formats out of the box. The configuration file lives at ~/.harneb/config.yaml and you will need to set your base epoch and at minimum specify whether you are working with UTC, TT, or TDB time standards. Most people skip that step and then spend three hours debugging why their timestamps are offset by exactly 64 milliseconds. Do not skip it.
Common Pitfalls Nobody Talks About
Beginners tend to treat the ephemeris database as immutable. It is not. Lunar orbital mechanics shift slightly year over year due to tidal forces and mass redistribution on Earth. If you are running a build from before 2022 without updating the ephemeris module, your corrections could be drifting by up to 12 milliseconds per year. I caught this on a case where a witness timestamp and a server log that should have been within 2 milliseconds of each other were showing a 14-millisecond gap. Updating the ephemeris to the latest JPL DE440 data fixed it completely. Another issue is the assumption that every source in your dataset needs correction. Some systems — mostly modern NTP-synchronized servers — do not benefit from the lunar correction layer at all and applying it actually introduces error. I ran into this when processing a hybrid dataset containing both a 1998-era VMS system and a 2024 cloud cluster. Applying the correction uniformly to everything made the VMS timestamps look better but pushed the cloud cluster timestamps further off. The workaround was to run a pre-scan using the --dry-correct flag, which reports the correction magnitude for each source without applying it. Anything below 0.5 milliseconds gets flagged as unnecessary and I excluded those sources from the main pass.
Get the Full Details
Performance Considerations
The tool is CPU-bound during the correction phase, especially if you are processing large pcap files with embedded timestamps. On a standard 16-core machine, a 2-gigabyte log file with about 4 million timestamped entries takes roughly 11 to 14 minutes to process with full ephemeris correction. If you disable the relativistic sub-layer by passing --no-relativistic, it drops to about 6 minutes and loses roughly 0.3 milliseconds of accuracy, which is acceptable for most internal investigations. For court-admissible work, keep the full pipeline enabled. Memory usage is the more common bottleneck. The tool loads the entire ephemeris dataset into RAM at startup, which is currently around 800 megabytes. If you are running this on a machine with less than 4 gigabytes of available memory, it will start swapping and performance degrades nonlinearly. I learned this the hard way on a constrained lab server where the process took 47 minutes instead of 14 because of swap thrashing. Moving the execution to a machine with 16 gigabytes of RAM brought it back to normal speed.
Lunar Justice Charles L Harneb Output and Integration
Generated output includes a corrected log file, a discrepancy report in PDF format, and a machine-readable JSON summary. The JSON summary is where most people want to hook their own pipelines. It contains per-source correction vectors, confidence intervals, and a flag for any entries that exceeded the maximum correction threshold. I usually pipe that JSON into a SQLite database and run queries against it rather than re-processing the raw logs repeatedly. That cuts my average follow-up analysis time from about 45 minutes down to under 8 minutes. The tool also supports custom plugins for additional time-source types. There is a community plugin for handling IRIDIUM satellite feed timestamps and another for legacy Inmarsat logs. Neither is officially maintained by the Harneb team, and the IRIDIUM plugin has a known bug where it misreads the epoch for pre-2005 transmissions. If you are working with older data from that source, apply a manual offset of negative 31 milliseconds after the plugin runs.
Limitations and When It Fails Completely
There are scenarios where this tool simply cannot help you. If your source data has no embedded timestamps at all — some proprietary protocols strip or never include them — then there is nothing to correct. You can apply external time-stamping, but the accuracy depends entirely on how close your external timer is to true UTC, and at that point you are just adding another variable with its own error margin. Another failure mode is when the ephemeris data itself is incomplete for the region you are investigating. The built-in database covers most of the well-monitored orbital paths, but there are blind spots in certain southern-hemisphere coverage zones where lunar satellite telemetry is sparse. In those cases, the tool falls back to interpolated positions, and the correction confidence drops to around 60 percent. I flag those entries explicitly in my reports so reviewers know the margin of uncertainty. If you are working primarily with terrestrial-only data sources and have no satellite or high-altitude relay involvement, this tool adds complexity without meaningful benefit. Standard NTP or PTP correction methods are faster, better documented, and less likely to introduce error through over-correction. Use this when you actually need it, not as a default step in every investigation.
Where to Get It
The official distribution is hosted on the Harneb research archive. The current stable build is version 3.7.2. There is also a nightly build channel if you need the latest ephemeris updates, but those are less tested and occasionally break backward compatibility with older configuration formats. I stick to stable releases for client work and only use nightlies for internal experimentation. The license is non-commercial academic, which means you can run it freely for investigative and research purposes but cannot embed it in a commercial product without negotiating a separate agreement. The download page and documentation are at harneb-project.org/tools.
