A Python-based Windows forensic triage tool that automates the collection and analysis of system artifacts after a suspected security incident.
The framework gathers key forensic artifacts, performs basic enrichment such as hash verification and signature validation, and generates structured HTML reports to assist investigators during post-incident analysis.
- Automated Windows artifact collection
- Modular forensic scanning architecture
- SHA-256 hash generation for executables
- Digital signature verification
- Optional threat intelligence verification
- Structured CSV evidence storage
- HTML report generation for investigation
This project utilizes third-party forensic utilities developed by NirSoft for artifact collection and analysis.
The following NirSoft tools are used:
- WinPrefetchView – For analyzing Windows Prefetch files
- USBLogView – For extracting USB device connection history
These tools are developed by Nir Sofer and are not distributed with this repository due to licensing restrictions. They are automatically downloaded from the official NirSoft website during setup.
Official NirSoft Website: https://www.nirsoft.net/
Full credit goes to Nir Sofer for developing and maintaining these forensic utilities.
The framework analyzes several Windows forensic artifacts such as:
- System information
- Live running processes
- Live network connections
- Firewall logs
- Prefetch execution artifacts
- Persistence mechanisms
- Startup folder entries
- Newly created services
- Registry Run keys
- Scheduled Tasks
- USB device activity
- Browser download artifacts
| Item | Details |
|---|---|
| Platform | Windows 10, Windows 11 |
| Python Version | 3.8+ |
| Privileges | Administrator |
Scanner_modules/
forensic_tools/
html_templates/
app_data/
main.py
- Scanner_modules – Modules responsible for artifact collection
- forensic_tools – External utilities used for specialized artifact parsing
- html_templates – Templates used to generate HTML reports
- app_data – Configuration and hash database storage
Follow the steps below to set up the Windows Forensic Artifact Collector:
Clone the repository:
git clone https://github.com/prakash-js/windows-forensic-artifact-collector.git
Navigate to the project directory:
cd windows-forensic-artifact-collector
Install the required Python dependencies:
pip install -r requirements.txt
Run the setup script to download required third-party forensic tools:
python setup.py
Run the main program:
python main.py
The tool will collect forensic artifacts and generate output inside a structured output directory.
The framework supports optional threat intelligence enrichment using Hybrid Analysis.
To enable this feature:
- Create an account on Hybrid Analysis.
- Generate an API key from your account dashboard.
- Add the API key inside the framework configuration.
Example configuration file:
app_data/config_file.py
Add your API key:
api_value = "your_hybrid_analysis_api_key"
If no API key is configured, the framework will continue to operate in offline mode without threat intelligence enrichment.
The framework generates the following directories during execution:
- Core_evidence – Raw collected artifacts
- Processed_evidence – Filtered and enriched evidence
- Reports – Generated HTML forensic reports
- sysinfo – Basic system information
Some framework settings can be customized through the configuration file:
app_data/config_file.py
This file allows investigators to define whitelisted IP addresses and which directories for file analysis.
Certain IP addresses can be excluded from firewall analysis to reduce noise from trusted infrastructure.
Example configuration:
self.whitelisted_ips = {
"ip_address": {
'8.8.8.8',
'127.0.0.1',
'8.8.4.4',
'1.1.1.1',
'224.0.0.251',
'ff02::fb',
'::1'
}
}
These IP addresses will be ignored during firewall log analysis.
Investigators can define directories that should be included in file analysis.
Example:
self.directory_config = {
"directories": [
"add//dir//here//",
"other//dir//"
]
}
The tool will analyze files in selected directories, especially recently created or modified files.
This framework is functional for Windows forensic triage and HTML report generation for the artifacts currently supported.
The project is currently under active development. Additional artifact scanners and analysis features are being added to improve forensic investigation and incident response capabilities.
Documentation is currently being added and updated in this repository here.
This tool is intended for educational and research purposes in digital forensics and incident response.