How jivis05/forendisk-triage works
ForenDisk is a digital-forensics triage application with CLI and Streamlit entry points. Investigators register cases and disk-image evidence, verify hashes and metadata, then analyze artifacts through carving, string classification, IOC detection, browser parsing, and log auditing. Findings support risk scoring, a unified timeline, chain-of-custody records, and generated reports. The README documents the broader analysis workflow; sampled source confirms selected database, IOC, browser, log, risk, and report behaviors, but does not expose the full CLI orchestration, so uncertain internal call links are omitted.
Main entry points: db.py Case Database · streamlit_app.py Dashboard · main.py CLI · evidence Disk Image
Components 20
Evidence Intake
- Hash Verification
analyzer/hashing.py - Metadata Extraction
analyzer/metadata.py - Signature Detection
analyzer/signatures.py
Artifact Analysis
- File Carving
analyzer/carving.py - Recovered Files
recovered - String Classification
analyzer/strings.py - IOC Detection
analyzer/ioc.py - Browser Parsing
analyzer/browser.py - Log Auditing
analyzer/log_parser.py - Timeline Compilation
analyzer/timeline.py
Case Records
- Custody Tracking
analyzer/custody.py - Case Database
analyzer/db.py - Known Hash Registry
analyzer/hashing.py
Assessment and Outputs
- Risk Assessment
analyzer/risk.py - Report Generator
analyzer/report.py - Generated Reports
reports
Other components
- Investigator
- Disk Image
evidence
Connections 30
- Investigator → CLI: issues commands
- Investigator → Dashboard: uses interface
- CLI → Case Database: registers case
- CLI → Custody Tracking: records custody
- CLI → Disk Image: selects evidence
- Dashboard → Case Database: manages cases
- Dashboard → Disk Image: selects evidence
- Dashboard → Hash Verification: verifies integrity
- Dashboard → Signature Detection: detects type
- Hash Verification → Known Hash Registry: looks up hashes
- CLI → Hash Verification: verifies integrity
- CLI → Signature Detection: detects type
- CLI → Case Database: registers evidence
- File Carving → Disk Image: scans image
- File Carving → Recovered Files: writes carved files
- String Classification → Disk Image: extracts strings
- String Classification → Case Database: stores findings
- IOC Detection → Case Database: reads strings
- IOC Detection → Case Database: stores indicators
- Browser Parsing → Recovered Files: scans databases
- Browser Parsing → Case Database: stores artifacts
- Log Auditing → Case Database: stores events
- Log Auditing → Timeline Compilation: records events
- Risk Assessment → Case Database: reads findings
- Risk Assessment → Case Database: updates score
- Report Generator → Case Database: reads case results
- Report Generator → Generated Reports: generates reports
- Dashboard → IOC Detection: starts scan
- Dashboard → Browser Parsing: starts audit
- Dashboard → Log Auditing: starts audit