# andrew25566/windows-process-forensics architecture

> Architecture diagram of the GitHub repository andrew25566/windows-process-forensics, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/andrew25566/windows-process-forensics
- Repository: https://github.com/andrew25566/windows-process-forensics
- Video tour (about a minute): https://gitdiagram.com/andrew25566/windows-process-forensics/video

## Overview

This single-file Windows forensics CLI takes a PID, queries Windows through PowerShell/CIM, gathers executable-file evidence, and prints a process investigation report. The script orchestrates separate evidence-gathering stages: selected-process details, executable metadata and SHA-256, parent and child relationships, loaded modules, TCP connections, and the backward parent chain. These are logical responsibilities within one file, not separate subsystems. The README documents the broader capabilities; the sampled source supports the relationships shown here. No persistent store or optional integration is implemented.

Main entry points: [`process_tree.py`](https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py) (Forensics CLI)

## Diagram (Mermaid)

```mermaid
flowchart TD

node_investigator(("Investigator"))
node_cli["Forensics CLI<br/>[process_tree.py]"]
node_process_query["Process Query<br/>[process_tree.py]"]
node_file_evidence["File Evidence<br/>[process_tree.py]"]
node_relationships["Process Relations<br/>[process_tree.py]"]
node_modules["Loaded Modules<br/>[process_tree.py]"]
node_connections["TCP Connections<br/>[process_tree.py]"]
node_powershell_runner["PowerShell Runner<br/>[process_tree.py]"]
node_powershell["PowerShell"]
node_windows_process["Windows Process APIs"]
node_windows_network["Windows Network APIs"]
node_filesystem["Executable Filesystem"]
node_report["Investigation Report<br/>[process_tree.py]"]

node_investigator -->|"enters PID"| node_cli
node_cli -->|"queries selected process"| node_process_query
node_cli -->|"checks executable"| node_file_evidence
node_cli -->|"queries relationships"| node_relationships
node_cli -->|"queries modules"| node_modules
node_cli -->|"queries connections"| node_connections
node_process_query -->|"runs query"| node_powershell_runner
node_relationships -->|"queries parent chain"| node_process_query
node_relationships -->|"runs child query"| node_powershell_runner
node_modules -->|"runs query"| node_powershell_runner
node_connections -->|"runs query"| node_powershell_runner
node_powershell_runner -->|"launches command"| node_powershell
node_powershell -->|"queries CIM"| node_windows_process
node_powershell -->|"queries TCP"| node_windows_network
node_file_evidence -->|"reads metadata and bytes"| node_filesystem
node_cli -->|"prints findings"| node_report
node_process_query -->|"supplies process data"| node_report
node_file_evidence -->|"supplies file evidence"| node_report
node_relationships -->|"supplies relationships"| node_report
node_modules -->|"supplies module list"| node_report
node_connections -->|"supplies connections"| node_report

click node_cli "https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py"
click node_process_query "https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py"
click node_file_evidence "https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py"
click node_relationships "https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py"
click node_modules "https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py"
click node_connections "https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py"
click node_powershell_runner "https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py"
click node_report "https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_investigator,node_powershell,node_filesystem toneIndigo
class node_cli,node_process_query,node_file_evidence,node_relationships,node_modules,node_connections,node_powershell_runner,node_report toneTeal
class node_windows_process,node_windows_network toneMint
```

## Components

### Other components

- **Investigator**
- [Forensics CLI](https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py): `process_tree.py`
- [Process Query](https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py): `process_tree.py`
- [File Evidence](https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py): `process_tree.py`
- [Process Relations](https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py): `process_tree.py`
- [Loaded Modules](https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py): `process_tree.py`
- [TCP Connections](https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py): `process_tree.py`
- [PowerShell Runner](https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py): `process_tree.py`
- **PowerShell**
- **Windows Process APIs**
- **Windows Network APIs**
- **Executable Filesystem**
- [Investigation Report](https://github.com/andrew25566/windows-process-forensics/blob/main/process_tree.py): `process_tree.py`

## Connections

- Investigator → Forensics CLI: enters PID
- Forensics CLI → Process Query: queries selected process
- Forensics CLI → File Evidence: checks executable
- Forensics CLI → Process Relations: queries relationships
- Forensics CLI → Loaded Modules: queries modules
- Forensics CLI → TCP Connections: queries connections
- Process Query → PowerShell Runner: runs query
- Process Relations → Process Query: queries parent chain
- Process Relations → PowerShell Runner: runs child query
- Loaded Modules → PowerShell Runner: runs query
- TCP Connections → PowerShell Runner: runs query
- PowerShell Runner → PowerShell: launches command
- PowerShell → Windows Process APIs: queries CIM
- PowerShell → Windows Network APIs: queries TCP
- File Evidence → Executable Filesystem: reads metadata and bytes
- Forensics CLI → Investigation Report: prints findings
- Process Query → Investigation Report: supplies process data
- File Evidence → Investigation Report: supplies file evidence
- Process Relations → Investigation Report: supplies relationships
- Loaded Modules → Investigation Report: supplies module list
- TCP Connections → Investigation Report: supplies connections