How andrew25566/windows-process-forensics works
This single-file Windows forensics CLI takes a PID, queries Windows through PowerShell/CIM, gathers executable-file evidence, and prints a process investigation report. The script orchestrates separate evidence-gathering stages: selected-process details, executable metadata and SHA-256, parent and child relationships, loaded modules, TCP connections, and the backward parent chain. These are logical responsibilities within one file, not separate subsystems. The README documents the broader capabilities; the sampled source supports the relationships shown here. No persistent store or optional integration is implemented.
Main entry points: process_tree.py Forensics CLI
Components 13
Other components
- Investigator
- Forensics CLI
process_tree.py - Process Query
process_tree.py - File Evidence
process_tree.py - Process Relations
process_tree.py - Loaded Modules
process_tree.py - TCP Connections
process_tree.py - PowerShell Runner
process_tree.py - PowerShell
- Windows Process APIs
- Windows Network APIs
- Executable Filesystem
- Investigation Report
process_tree.py
Connections 21
- Investigator → Forensics CLI: enters PID
- Forensics CLI → Process Query: queries selected process
- Forensics CLI → File Evidence: checks executable
- Forensics CLI → Process Relations: queries relationships
- Forensics CLI → Loaded Modules: queries modules
- Forensics CLI → TCP Connections: queries connections
- Process Query → PowerShell Runner: runs query
- Process Relations → Process Query: queries parent chain
- Process Relations → PowerShell Runner: runs child query
- Loaded Modules → PowerShell Runner: runs query
- TCP Connections → PowerShell Runner: runs query
- PowerShell Runner → PowerShell: launches command
- PowerShell → Windows Process APIs: queries CIM
- PowerShell → Windows Network APIs: queries TCP
- File Evidence → Executable Filesystem: reads metadata and bytes
- Forensics CLI → Investigation Report: prints findings
- Process Query → Investigation Report: supplies process data
- File Evidence → Investigation Report: supplies file evidence
- Process Relations → Investigation Report: supplies relationships
- Loaded Modules → Investigation Report: supplies module list
- TCP Connections → Investigation Report: supplies connections