# jivis05/forendisk-triage architecture

> Architecture diagram of the GitHub repository jivis05/forendisk-triage, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/jivis05/forendisk-triage
- Repository: https://github.com/jivis05/forendisk-triage

## Overview

ForenDisk is a digital-forensics triage application with CLI and Streamlit entry points. Investigators register cases and disk-image evidence, verify hashes and metadata, then analyze artifacts through carving, string classification, IOC detection, browser parsing, and log auditing. Findings support risk scoring, a unified timeline, chain-of-custody records, and generated reports. The README documents the broader analysis workflow; sampled source confirms selected database, IOC, browser, log, risk, and report behaviors, but does not expose the full CLI orchestration, so uncertain internal call links are omitted.

Main entry points: [`analyzer/db.py`](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/db.py) (Case Database), [`dashboard/streamlit_app.py`](https://github.com/jivis05/forendisk-triage/blob/main/dashboard/streamlit_app.py) (Dashboard), [`main.py`](https://github.com/jivis05/forendisk-triage/blob/main/main.py) (CLI), [`evidence`](https://github.com/jivis05/forendisk-triage/tree/main/evidence) (Disk Image)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["Investigator Interfaces"]
  node_cli["CLI<br/>[main.py]"]
  node_dashboard["Dashboard<br/>[streamlit_app.py]"]
end

subgraph group_evidence["Evidence Intake"]
  node_hashing["Hash Verification<br/>[hashing.py]"]
  node_metadata["Metadata Extraction<br/>[metadata.py]"]
  node_signatures["Signature Detection<br/>[signatures.py]"]
end

subgraph group_analysis["Artifact Analysis"]
  node_carving["File Carving<br/>[carving.py]"]
  node_recovered["Recovered Files"]
  node_strings["String Classification<br/>[strings.py]"]
  node_ioc["IOC Detection<br/>[ioc.py]"]
  node_browser["Browser Parsing<br/>[browser.py]"]
  node_logs["Log Auditing<br/>[log_parser.py]"]
  node_timeline["Timeline Compilation<br/>[timeline.py]"]
end

subgraph group_records["Case Records"]
  node_custody["Custody Tracking<br/>[custody.py]"]
  node_case_db[("Case Database<br/>[db.py]")]
  node_known_hashes[("Known Hash Registry<br/>[hashing.py]")]
end

subgraph group_results["Assessment and Outputs"]
  node_risk["Risk Assessment<br/>[risk.py]"]
  node_report["Report Generator<br/>[report.py]"]
  node_report_files["Generated Reports"]
end

node_investigator(("Investigator"))
node_image["Disk Image"]

node_investigator -->|"issues commands"| node_cli
node_investigator -->|"uses interface"| node_dashboard
node_cli -->|"registers case"| node_case_db
node_cli -->|"records custody"| node_custody
node_cli -->|"selects evidence"| node_image
node_dashboard -->|"manages cases"| node_case_db
node_dashboard -->|"selects evidence"| node_image
node_dashboard -->|"verifies integrity"| node_hashing
node_dashboard -->|"detects type"| node_signatures
node_hashing -->|"looks up hashes"| node_known_hashes
node_cli -->|"verifies integrity"| node_hashing
node_cli -->|"detects type"| node_signatures
node_cli -->|"registers evidence"| node_case_db
node_carving -->|"scans image"| node_image
node_carving -->|"writes carved files"| node_recovered
node_strings -->|"extracts strings"| node_image
node_strings -->|"stores findings"| node_case_db
node_ioc -->|"reads strings"| node_case_db
node_ioc -->|"stores indicators"| node_case_db
node_browser -->|"scans databases"| node_recovered
node_browser -->|"stores artifacts"| node_case_db
node_logs -->|"stores events"| node_case_db
node_logs -->|"records events"| node_timeline
node_risk -->|"reads findings"| node_case_db
node_risk -->|"updates score"| node_case_db
node_report -->|"reads case results"| node_case_db
node_report -->|"generates reports"| node_report_files
node_dashboard -->|"starts scan"| node_ioc
node_dashboard -->|"starts audit"| node_browser
node_dashboard -->|"starts audit"| node_logs

click node_cli "https://github.com/jivis05/forendisk-triage/blob/main/main.py"
click node_dashboard "https://github.com/jivis05/forendisk-triage/blob/main/dashboard/streamlit_app.py"
click node_image "https://github.com/jivis05/forendisk-triage/tree/main/evidence"
click node_hashing "https://github.com/jivis05/forendisk-triage/blob/main/analyzer/hashing.py"
click node_metadata "https://github.com/jivis05/forendisk-triage/blob/main/analyzer/metadata.py"
click node_signatures "https://github.com/jivis05/forendisk-triage/blob/main/analyzer/signatures.py"
click node_carving "https://github.com/jivis05/forendisk-triage/blob/main/analyzer/carving.py"
click node_recovered "https://github.com/jivis05/forendisk-triage/tree/main/recovered"
click node_strings "https://github.com/jivis05/forendisk-triage/blob/main/analyzer/strings.py"
click node_ioc "https://github.com/jivis05/forendisk-triage/blob/main/analyzer/ioc.py"
click node_browser "https://github.com/jivis05/forendisk-triage/blob/main/analyzer/browser.py"
click node_logs "https://github.com/jivis05/forendisk-triage/blob/main/analyzer/log_parser.py"
click node_timeline "https://github.com/jivis05/forendisk-triage/blob/main/analyzer/timeline.py"
click node_custody "https://github.com/jivis05/forendisk-triage/blob/main/analyzer/custody.py"
click node_case_db "https://github.com/jivis05/forendisk-triage/blob/main/analyzer/db.py"
click node_known_hashes "https://github.com/jivis05/forendisk-triage/blob/main/analyzer/hashing.py"
click node_risk "https://github.com/jivis05/forendisk-triage/blob/main/analyzer/risk.py"
click node_report "https://github.com/jivis05/forendisk-triage/blob/main/analyzer/report.py"
click node_report_files "https://github.com/jivis05/forendisk-triage/tree/main/reports"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_dashboard toneBlue
class node_hashing,node_metadata,node_signatures toneAmber
class node_carving,node_recovered,node_strings,node_ioc,node_browser,node_logs,node_timeline toneMint
class node_custody,node_case_db,node_known_hashes toneRose
class node_risk,node_report,node_report_files,node_investigator toneIndigo
class node_image toneTeal
```

## Components

### Investigator Interfaces

- [CLI](https://github.com/jivis05/forendisk-triage/blob/main/main.py): `main.py`
- [Dashboard](https://github.com/jivis05/forendisk-triage/blob/main/dashboard/streamlit_app.py): `dashboard/streamlit_app.py`

### Evidence Intake

- [Hash Verification](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/hashing.py): `analyzer/hashing.py`
- [Metadata Extraction](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/metadata.py): `analyzer/metadata.py`
- [Signature Detection](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/signatures.py): `analyzer/signatures.py`

### Artifact Analysis

- [File Carving](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/carving.py): `analyzer/carving.py`
- [Recovered Files](https://github.com/jivis05/forendisk-triage/tree/main/recovered): `recovered`
- [String Classification](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/strings.py): `analyzer/strings.py`
- [IOC Detection](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/ioc.py): `analyzer/ioc.py`
- [Browser Parsing](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/browser.py): `analyzer/browser.py`
- [Log Auditing](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/log_parser.py): `analyzer/log_parser.py`
- [Timeline Compilation](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/timeline.py): `analyzer/timeline.py`

### Case Records

- [Custody Tracking](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/custody.py): `analyzer/custody.py`
- [Case Database](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/db.py): `analyzer/db.py`
- [Known Hash Registry](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/hashing.py): `analyzer/hashing.py`

### Assessment and Outputs

- [Risk Assessment](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/risk.py): `analyzer/risk.py`
- [Report Generator](https://github.com/jivis05/forendisk-triage/blob/main/analyzer/report.py): `analyzer/report.py`
- [Generated Reports](https://github.com/jivis05/forendisk-triage/tree/main/reports): `reports`

### Other components

- **Investigator**
- [Disk Image](https://github.com/jivis05/forendisk-triage/tree/main/evidence): `evidence`

## Connections

- Investigator → CLI: issues commands
- Investigator → Dashboard: uses interface
- CLI → Case Database: registers case
- CLI → Custody Tracking: records custody
- CLI → Disk Image: selects evidence
- Dashboard → Case Database: manages cases
- Dashboard → Disk Image: selects evidence
- Dashboard → Hash Verification: verifies integrity
- Dashboard → Signature Detection: detects type
- Hash Verification → Known Hash Registry: looks up hashes
- CLI → Hash Verification: verifies integrity
- CLI → Signature Detection: detects type
- CLI → Case Database: registers evidence
- File Carving → Disk Image: scans image
- File Carving → Recovered Files: writes carved files
- String Classification → Disk Image: extracts strings
- String Classification → Case Database: stores findings
- IOC Detection → Case Database: reads strings
- IOC Detection → Case Database: stores indicators
- Browser Parsing → Recovered Files: scans databases
- Browser Parsing → Case Database: stores artifacts
- Log Auditing → Case Database: stores events
- Log Auditing → Timeline Compilation: records events
- Risk Assessment → Case Database: reads findings
- Risk Assessment → Case Database: updates score
- Report Generator → Case Database: reads case results
- Report Generator → Generated Reports: generates reports
- Dashboard → IOC Detection: starts scan
- Dashboard → Browser Parsing: starts audit
- Dashboard → Log Auditing: starts audit