# ajmartel/irtriage architecture

> Architecture diagram of the GitHub repository ajmartel/irtriage, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-23). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ajmartel/irtriage
- Repository: https://github.com/ajmartel/irtriage

## Overview

1. **Repository purpose**
   - This is an **incident-response triage toolkit** for Windows endpoints.
   - The main job of the project is to **collect forensic artifacts quickly** from a live machine without imaging the full disk.

2. **Primary runtime entry point**
   - The top-level **`IRTriage.au3` / `IRTriage.exe`** is the core application.
   - It is an **AutoIt-based GUI** that orchestrates data collection, likely with per-category tabs and options.
   - The UI is the control plane; the collected data is the output plane.

3. **Evidence collection workflow**
   - The application creates a **new output folder named with hostname + date/time**.
   - It gathers artifacts such as:
     - system information
     - network information
     - registry hives
     - disk metadata
     - memory dumps
   - It also records activity into **`IncidentLog.csv`** and command-execution logs.

4. **Local toolchain boundary**
   - Almost all functionality depends on **bundled binaries under `Compile/Tools`** rather than external installations.
   - This makes the repo effectively a **portable triage workstation packaged inside the project**.
   - The application invokes these helpers as subprocesses and captures their outputs into the case folder.

5. **Forensic subsystems**
   - The toolkit is composed of several forensic subdomains:
     - **memory acquisition**: Moonsols Win32/64dd or FDpro
     - **registry analysis**: RegRipper
     - **filesystem / disk analysis**: The Sleuth Kit
     - **prefetch / artifact viewing**: NirSoft utilities
     - **process and system enumeration**: Sysinternals utilities and Windows built-ins
   - These are not separate services; they are integrated command-line dependencies.

6. **Volume Shadow Copy support**
   - A notable capability is collecting from **Volume Shadow Copy**.
   - Architecturally, this means the tool is not limited to the live filesystem state; it can pull artifacts from historical snapshots to help defeat simple anti-forensic deletion.

7. **Built-in command layer**
   - The repo includes a custom **ReactOS-derived `cmd.exe`** in `Compile/Tools/cmd.exe`.
   - The README indicates it adds Linux-like aliases and forensic-oriented commands such as `privilege` and `info`.
   - This shell acts as an auxiliary command interpreter for analysts during triage, not as the main application UI.

8. **Update and maintenance subsystem**
   - The `Compile/Tools/Updater` folder suggests an **update-check / downloader utility**.
   - The project appears to support checking GitHub-hosted updates and downloading newer tool/app versions.
   - `Update.nfo` and the README’s version notes reinforce that the project has a lightweight update distribution path.

9. **Packaged tool families**
   - The `Compile/Tools` tree is organized by vendor/tool family:
     - **SysinternalsSuite**
     - **SleuthKit**
     - **RegRipper2.8**
     - **NirSoft**
     - **UnixUtils**
     - **Moonsols**
     - **Malware-Hunters**
   - Each folder is a deployment boundary for a specific class of triage capability, which is useful when drawing the architecture as pluggable external helpers.

10. **Output artifacts and analyst handoff**
    - The outputs are designed for **offline analyst review**, not immediate remediation.
    - Key outputs include CSV logs, parsed artifact exports, copied registry hives, disk listings, and memory capture files.
    - The `Docs` folder supports this handoff with comparison material and triage help documents.

11. **Operational constraint**
    - The tool is intended to run **locally on the evidence machine**, ideally from a USB drive.
    - Because memory dumping may require space larger than installed RAM, storage capacity is a practical architectural constraint.
    - The app tries to elevate to **Administrator** automatically on supported Windows versions, which is necessary for many collection actions.

12. **How to think about the architecture**
    - The cleanest diagram is: **Analyst launches IRTriage GUI → GUI selects modules → AutoIt script orchestrates local CLI tools → artifacts are written into a case folder + CSV logs → analyst reviews outputs or updates tooling**.
    - The external boundaries are the **Windows endpoint being triaged**, the **bundled helper binaries**, and optionally **GitHub/update resources** for maintenance.

Main entry points: [`IRTriage.au3`](https://github.com/ajmartel/irtriage/blob/master/IRTriage.au3) (IRTriage GUI), [`Compile/Tools/cmd.exe`](https://github.com/ajmartel/irtriage/blob/master/Compile/Tools/cmd.exe) (Cmd shell), [`Compile/Tools/Updater`](https://github.com/ajmartel/irtriage/tree/master/Compile/Tools/Updater) (Updater), [`Docs`](https://github.com/ajmartel/irtriage/tree/master/Docs) (Triage docs)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_g1["Control plane"]
  node_n1["IRTriage GUI<br/>AutoIt app<br/>[IRTriage.au3]"]
  node_n2["Cmd shell<br/>aux shell<br/>[cmd.exe]"]
end

subgraph group_g2["Evidence workflow"]
  node_n3[("Case folder<br/>output workspace")]
  node_n4["Incident log<br/>CSV log"]
  node_n5["System info<br/>collection module"]
  node_n6["Network info<br/>collection module"]
  node_n7["Registry hives<br/>collection module"]
  node_n8["Disk metadata<br/>collection module"]
  node_n9["Memory dump<br/>collection module"]
  node_n10(("Shadow copy<br/>collection source"))
end

subgraph group_g3["Bundled tools"]
  node_n11["Sysinternals<br/>tool family"]
  node_n12["RegRipper<br/>tool family<br/>[RegRipper2.8]"]
  node_n13["Sleuth Kit<br/>tool family<br/>[sleuthkit-4.2.0]"]
  node_n14["NirSoft<br/>tool family"]
  node_n15["Moonsols<br/>tool family"]
  node_n16["FDPro<br/>memory tool<br/>[fdpro.exe]"]
  node_n17["Unix utils<br/>tool family"]
end

subgraph group_g4["Maintenance"]
  node_n18["Updater<br/>maintenance utility"]
  node_n19(("GitHub updates<br/>remote source"))
end

subgraph group_g5["Reference"]
  node_n20["Triage docs<br/>reference docs"]
end

node_n1 -->|"creates"| node_n3
node_n1 -->|"records"| node_n4
node_n1 -->|"collects"| node_n5
node_n1 -->|"collects"| node_n6
node_n1 -->|"collects"| node_n7
node_n1 -->|"collects"| node_n8
node_n1 -->|"acquires"| node_n9
node_n1 -->|"uses"| node_n10
node_n5 -->|"invokes"| node_n11
node_n6 -->|"invokes"| node_n11
node_n7 -->|"invokes"| node_n12
node_n8 -->|"invokes"| node_n13
node_n5 -->|"invokes"| node_n14
node_n9 -->|"invokes"| node_n15
node_n9 -->|"fallback"| node_n16
node_n1 -->|"pipes through"| node_n17
node_n18 -->|"checks"| node_n19
node_n18 -->|"updates"| node_n1
node_n20 -->|"supports"| node_n1
node_n2 -->|"interacts"| node_n3
node_n2 -->|"supports"| node_n20

click node_n1 "https://github.com/ajmartel/irtriage/blob/master/IRTriage.au3"
click node_n2 "https://github.com/ajmartel/irtriage/blob/master/Compile/Tools/cmd.exe"
click node_n11 "https://github.com/ajmartel/irtriage/tree/master/Compile/Tools/SysinternalsSuite"
click node_n12 "https://github.com/ajmartel/irtriage/blob/master/Compile/Tools/RegRipper2.8"
click node_n13 "https://github.com/ajmartel/irtriage/blob/master/Compile/Tools/sleuthkit-4.2.0"
click node_n14 "https://github.com/ajmartel/irtriage/tree/master/Compile/Tools/NirSoft"
click node_n15 "https://github.com/ajmartel/irtriage/tree/master/Compile/Tools/Moonsols"
click node_n16 "https://github.com/ajmartel/irtriage/blob/master/Compile/Tools/fdpro.exe"
click node_n17 "https://github.com/ajmartel/irtriage/tree/master/Compile/Tools/UnixUtils"
click node_n18 "https://github.com/ajmartel/irtriage/tree/master/Compile/Tools/Updater"
click node_n20 "https://github.com/ajmartel/irtriage/tree/master/Docs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_n1,node_n2 toneBlue
class node_n3,node_n4,node_n5,node_n6,node_n7,node_n8,node_n9,node_n10 toneAmber
class node_n11,node_n12,node_n13,node_n14,node_n15,node_n16,node_n17 toneMint
class node_n18,node_n19 toneRose
class node_n20 toneIndigo
```

## Components

### Control plane

Primary UI and command shell for triage operations

- [IRTriage GUI](https://github.com/ajmartel/irtriage/blob/master/IRTriage.au3): AutoIt app · Main incident-response triage application and orchestration entry point · `IRTriage.au3`
- [Cmd shell](https://github.com/ajmartel/irtriage/blob/master/Compile/Tools/cmd.exe): aux shell · Bundled ReactOS-derived command interpreter for analyst use · `Compile/Tools/cmd.exe`

### Evidence workflow

Case creation, collection, logging, and analyst handoff

- **Case folder**: output workspace · Per-host, per-run evidence directory created for collected artifacts
- **Incident log**: CSV log · Structured run log of collected artifacts and actions
- **System info**: collection module · Collects endpoint, user, and machine inventory data
- **Network info**: collection module · Collects network configuration and connectivity evidence
- **Registry hives**: collection module · Copies registry hives and supports registry-centric analysis
- **Disk metadata**: collection module · Enumerates volume, filesystem, and disk structure evidence
- **Memory dump**: collection module · Captures volatile memory for later offline analysis
- **Shadow copy**: collection source · Historical snapshot source used to recover artifacts beyond the live filesystem

### Bundled tools

Packaged forensic utilities invoked locally as helpers

- [Sysinternals](https://github.com/ajmartel/irtriage/tree/master/Compile/Tools/SysinternalsSuite): tool family · Process, autorun, and system enumeration utilities · `Compile/Tools/SysinternalsSuite`
- [RegRipper](https://github.com/ajmartel/irtriage/blob/master/Compile/Tools/RegRipper2.8): tool family · Registry parsing and artifact extraction toolkit · `Compile/Tools/RegRipper2.8`
- [Sleuth Kit](https://github.com/ajmartel/irtriage/blob/master/Compile/Tools/sleuthkit-4.2.0): tool family · Filesystem and disk forensics utilities · `Compile/Tools/sleuthkit-4.2.0`
- [NirSoft](https://github.com/ajmartel/irtriage/tree/master/Compile/Tools/NirSoft): tool family · Portable artifact viewers and parsers · `Compile/Tools/NirSoft`
- [Moonsols](https://github.com/ajmartel/irtriage/tree/master/Compile/Tools/Moonsols): tool family · Memory acquisition tooling · `Compile/Tools/Moonsols`
- [FDPro](https://github.com/ajmartel/irtriage/blob/master/Compile/Tools/fdpro.exe): memory tool · Alternative memory acquisition binary · `Compile/Tools/fdpro.exe`
- [Unix utils](https://github.com/ajmartel/irtriage/tree/master/Compile/Tools/UnixUtils): tool family · Text and stream helpers used by orchestration scripts · `Compile/Tools/UnixUtils`

### Maintenance

Update and distribution utilities

- [Updater](https://github.com/ajmartel/irtriage/tree/master/Compile/Tools/Updater): maintenance utility · Update-check and downloader subsystem for tools and app versions · `Compile/Tools/Updater`
- **GitHub updates**: remote source · Remote update metadata and downloads source

### Reference

Analyst-facing documentation

- [Triage docs](https://github.com/ajmartel/irtriage/tree/master/Docs): reference docs · Operator guidance, comparisons, and triage help materials · `Docs`

## Connections

- IRTriage GUI → Case folder: creates · Initializes a new hostname-timestamp case workspace
- IRTriage GUI → Incident log: records · Writes incident activity and command results
- IRTriage GUI → System info: collects · Runs system inventory collection
- IRTriage GUI → Network info: collects · Runs network inventory collection
- IRTriage GUI → Registry hives: collects · Copies registry artifacts for offline analysis
- IRTriage GUI → Disk metadata: collects · Extracts disk and filesystem metadata
- IRTriage GUI → Memory dump: acquires · Triggers memory capture workflow
- IRTriage GUI → Shadow copy: uses · Targets shadow copies when available
- System info → Sysinternals: invokes · Uses Sysinternals and built-in tools for enumeration
- Network info → Sysinternals: invokes · Uses network-oriented helper binaries
- Registry hives → RegRipper: invokes · Uses registry parsing helpers
- Disk metadata → Sleuth Kit: invokes · Uses disk and filesystem utilities
- System info → NirSoft: invokes · Uses artifact viewers where needed
- Memory dump → Moonsols: invokes · Uses bundled memory acquisition tooling
- Memory dump → FDPro: fallback · Alternative memory capture executable
- IRTriage GUI → Unix utils: pipes through · Uses stream utilities in orchestration scripts
- Updater → GitHub updates: checks · Pulls update metadata and packages from GitHub-hosted resources
- Updater → IRTriage GUI: updates · Maintains application and tool distribution path
- Triage docs → IRTriage GUI: supports · Provides operator guidance for triage workflows
- Cmd shell → Case folder: interacts · Used by analysts during live triage on the evidence machine
- Cmd shell → Triage docs: supports · Provides a command layer for manual investigation