# ayushbadwaik/cm23051-tae-cyberforensic architecture

> Architecture diagram of the GitHub repository ayushbadwaik/cm23051-tae-cyberforensic, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ayushbadwaik/cm23051-tae-cyberforensic
- Repository: https://github.com/ayushbadwaik/cm23051-tae-cyberforensic

## Overview

This is a Windows Registry forensics web application and API. An investigator requests a scan in simulated-scenario or live-host mode; the server loads evidence, parses registry artifacts, computes threat and timeline results, and exposes them through API endpoints and a Markdown report. The documented artifact domains include system details, autoruns, UserAssist, USB devices, typed URLs, services, and recent documents. Source excerpts are partial, so parser internals and any frontend implementation are not mapped beyond the supported interfaces.

Main entry points: [`registry_parser.py`](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py) (Registry Parser), [`app.py`](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/app.py) (HTTP API Server), [`threat_detector.py`](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/threat_detector.py) (Threat Analysis), [`evidence_generator.py`](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/evidence_generator.py) (Scenario Evidence)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interface["API and Reporting"]
  node_server["HTTP API Server<br/>[app.py]"]
  node_case_state["Current Case State<br/>[app.py]"]
  node_report["Markdown Report<br/>[app.py]"]
end

subgraph group_evidence["Evidence Sources"]
  node_scenario_data["Scenario Evidence"]
  node_windows_registry[("Windows Registry")]
end

subgraph group_forensics["Forensic Processing"]
  node_parser["Registry Parser<br/>[registry_parser.py]"]
  node_system_info["System Details<br/>[registry_parser.py]"]
  node_autoruns["Autoruns<br/>[registry_parser.py]"]
  node_user_assist["UserAssist Activity<br/>[registry_parser.py]"]
  node_usb_devices["USB Devices<br/>[registry_parser.py]"]
  node_typed_urls["Typed URLs<br/>[registry_parser.py]"]
  node_services["Services<br/>[registry_parser.py]"]
  node_recent_docs["Recent Documents<br/>[registry_parser.py]"]
end

subgraph group_results["Investigation Results"]
  node_detector["Threat Analysis<br/>[threat_detector.py]"]
  node_threats["Threat Findings<br/>[threat_detector.py]"]
  node_timeline["Forensic Timeline<br/>[threat_detector.py]"]
end

node_investigator(("Investigator"))

node_investigator -->|"requests scan"| node_server
node_server -->|"loads scenarios"| node_scenario_data
node_server -->|"creates parser"| node_parser
node_scenario_data -->|"supplies hive data"| node_parser
node_parser -->|"reads registry"| node_windows_registry
node_parser -->|"extracts"| node_system_info
node_parser -->|"extracts"| node_autoruns
node_parser -->|"extracts"| node_user_assist
node_parser -->|"extracts"| node_usb_devices
node_parser -->|"extracts"| node_typed_urls
node_parser -->|"extracts"| node_services
node_parser -->|"extracts"| node_recent_docs
node_parser -->|"returns artifacts"| node_server
node_server -->|"analyzes artifacts"| node_detector
node_detector -->|"returns results"| node_server
node_server -->|"updates"| node_case_state
node_server -->|"generates"| node_report
node_investigator -->|"requests results"| node_server
node_server -->|"serves API and report"| node_investigator
node_detector -->|"produces"| node_threats
node_detector -->|"reconstructs"| node_timeline

click node_server "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/app.py"
click node_case_state "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/app.py"
click node_report "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/app.py"
click node_scenario_data "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/evidence_generator.py"
click node_parser "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py"
click node_system_info "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py"
click node_autoruns "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py"
click node_user_assist "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py"
click node_usb_devices "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py"
click node_typed_urls "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py"
click node_services "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py"
click node_recent_docs "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py"
click node_detector "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/threat_detector.py"
click node_threats "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/threat_detector.py"
click node_timeline "https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/threat_detector.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_server,node_case_state,node_report toneBlue
class node_scenario_data,node_windows_registry toneAmber
class node_parser,node_system_info,node_autoruns,node_user_assist,node_usb_devices,node_typed_urls,node_services,node_recent_docs toneMint
class node_detector,node_threats,node_timeline toneRose
class node_investigator toneIndigo
```

## Components

### API and Reporting

- [HTTP API Server](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/app.py): `app.py`
- [Current Case State](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/app.py): `app.py`
- [Markdown Report](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/app.py): `app.py`

### Evidence Sources

- [Scenario Evidence](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/evidence_generator.py): `evidence_generator.py`
- **Windows Registry**

### Forensic Processing

- [Registry Parser](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py): `registry_parser.py`
- [System Details](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py): `registry_parser.py`
- [Autoruns](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py): `registry_parser.py`
- [UserAssist Activity](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py): `registry_parser.py`
- [USB Devices](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py): `registry_parser.py`
- [Typed URLs](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py): `registry_parser.py`
- [Services](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py): `registry_parser.py`
- [Recent Documents](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/registry_parser.py): `registry_parser.py`

### Investigation Results

- [Threat Analysis](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/threat_detector.py): `threat_detector.py`
- [Threat Findings](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/threat_detector.py): `threat_detector.py`
- [Forensic Timeline](https://github.com/ayushbadwaik/cm23051-tae-cyberforensic/blob/main/threat_detector.py): `threat_detector.py`

### Other components

- **Investigator**

## Connections

- Investigator → HTTP API Server: requests scan
- HTTP API Server → Scenario Evidence: loads scenarios
- HTTP API Server → Registry Parser: creates parser
- Scenario Evidence → Registry Parser: supplies hive data
- Registry Parser → Windows Registry: reads registry
- Registry Parser → System Details: extracts
- Registry Parser → Autoruns: extracts
- Registry Parser → UserAssist Activity: extracts
- Registry Parser → USB Devices: extracts
- Registry Parser → Typed URLs: extracts
- Registry Parser → Services: extracts
- Registry Parser → Recent Documents: extracts
- Registry Parser → HTTP API Server: returns artifacts
- HTTP API Server → Threat Analysis: analyzes artifacts
- Threat Analysis → HTTP API Server: returns results
- HTTP API Server → Current Case State: updates
- HTTP API Server → Markdown Report: generates
- Investigator → HTTP API Server: requests results
- HTTP API Server → Investigator: serves API and report
- Threat Analysis → Threat Findings: produces
- Threat Analysis → Forensic Timeline: reconstructs