How ayushbadwaik/cm23051-tae-cyberforensic works
This is a Windows Registry forensics web application and API. An investigator requests a scan in simulated-scenario or live-host mode; the server loads evidence, parses registry artifacts, computes threat and timeline results, and exposes them through API endpoints and a Markdown report. The documented artifact domains include system details, autoruns, UserAssist, USB devices, typed URLs, services, and recent documents. Source excerpts are partial, so parser internals and any frontend implementation are not mapped beyond the supported interfaces.
Main entry points: registry_parser.py Registry Parser · app.py HTTP API Server · threat_detector.py Threat Analysis · evidence_generator.py Scenario Evidence
Components 17
API and Reporting
- HTTP API Server
app.py - Current Case State
app.py - Markdown Report
app.py
Evidence Sources
- Scenario Evidence
evidence_generator.py - Windows Registry
Forensic Processing
- Registry Parser
registry_parser.py - System Details
registry_parser.py - Autoruns
registry_parser.py - UserAssist Activity
registry_parser.py - USB Devices
registry_parser.py - Typed URLs
registry_parser.py - Services
registry_parser.py - Recent Documents
registry_parser.py
Investigation Results
- Threat Analysis
threat_detector.py - Threat Findings
threat_detector.py - Forensic Timeline
threat_detector.py
Other components
- Investigator
Connections 21
- Investigator → HTTP API Server: requests scan
- HTTP API Server → Scenario Evidence: loads scenarios
- HTTP API Server → Registry Parser: creates parser
- Scenario Evidence → Registry Parser: supplies hive data
- Registry Parser → Windows Registry: reads registry
- Registry Parser → System Details: extracts
- Registry Parser → Autoruns: extracts
- Registry Parser → UserAssist Activity: extracts
- Registry Parser → USB Devices: extracts
- Registry Parser → Typed URLs: extracts
- Registry Parser → Services: extracts
- Registry Parser → Recent Documents: extracts
- Registry Parser → HTTP API Server: returns artifacts
- HTTP API Server → Threat Analysis: analyzes artifacts
- Threat Analysis → HTTP API Server: returns results
- HTTP API Server → Current Case State: updates
- HTTP API Server → Markdown Report: generates
- Investigator → HTTP API Server: requests results
- HTTP API Server → Investigator: serves API and report
- Threat Analysis → Threat Findings: produces
- Threat Analysis → Forensic Timeline: reconstructs