# rasheed-cy/digitalforensicstool architecture

> Architecture diagram of the GitHub repository rasheed-cy/digitalforensicstool, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/rasheed-cy/digitalforensicstool
- Repository: https://github.com/rasheed-cy/digitalforensicstool

## Overview

Digital Forensics Toolkit is a desktop Windows-artifact forensics application. Its primary workflow is a Tkinter interface offering automatic collection and individual artifact viewers; the automatic-collection screen creates a case, gathers evidence, computes SHA-256 hashes, and packages results. Separate artifact modules cover thumbnail caches, Jump Lists, Recycle Bin, Prefetch, ShimCache, Amcache, SRUM, and $MFT. The supplied excerpts confirm several parser behaviors and the case manager, but not the full collector-to-hasher/report wiring, so those uncertain links are omitted.

Main entry points: [`main.py`](https://github.com/rasheed-cy/digitalforensicstool/blob/main/main.py) (Desktop app), [`gui/auto_gui.py`](https://github.com/rasheed-cy/digitalforensicstool/blob/main/gui/auto_gui.py) (Auto collection UI), [`gui/viewer.py`](https://github.com/rasheed-cy/digitalforensicstool/blob/main/gui/viewer.py) (Thumbnail viewer), [`jumplists/jl_gui.py`](https://github.com/rasheed-cy/digitalforensicstool/blob/main/jumplists/jl_gui.py) (Jump List viewer)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_app["Application interface"]
  node_main["Desktop app<br/>[main.py]"]
  node_auto_ui["Auto collection UI<br/>[auto_gui.py]"]
  node_viewer_ui["Thumbnail viewer<br/>[viewer.py]"]
  node_jump_ui["Jump List viewer<br/>[jl_gui.py]"]
  node_recycle_ui["Recycle Bin viewer<br/>[rb_gui.py]"]
  node_prefetch_ui["Prefetch viewer<br/>[pf_gui.py]"]
  node_shim_ui["ShimCache viewer<br/>[sc_gui.py]"]
  node_amcache_ui["Amcache viewer<br/>[am_gui.py]"]
  node_srum_ui["SRUM viewer<br/>[srum_gui.py]"]
  node_mft_ui["MFT viewer<br/>[mft_gui.py]"]
end

subgraph group_artifacts["Artifact analysis"]
  node_thumb_parser["Thumbcache parser<br/>[parser.py]"]
  node_jump_parser["Jump List parser<br/>[jl_parser.py]"]
  node_recycle_parser["Recycle Bin parser<br/>[rb_parser.py]"]
  node_prefetch_parser["Prefetch parser<br/>[pf_parser.py]"]
  node_shim_parser["ShimCache parser<br/>[sc_parser.py]"]
  node_amcache_parser["Amcache parser<br/>[am_parser.py]"]
  node_srum_parser["SRUM parser<br/>[srum_parser.py]"]
  node_mft_parser["MFT parser<br/>[mft_parser.py]"]
end

subgraph group_collection["Case collection"]
  node_case_manager["Case manager<br/>[case_manager.py]"]
  node_auto_collector["Auto collector<br/>[auto_collector.py]"]
  node_hasher["Evidence hasher<br/>[hasher.py]"]
  node_reporter["Report generator"]
  node_packager["ZIP packager<br/>[packager.py]"]
end

node_investigator(("Investigator"))

node_investigator -->|"opens"| node_main
node_main -->|"creates tab"| node_auto_ui
node_main -->|"creates tab"| node_viewer_ui
node_main -->|"creates tab"| node_jump_ui
node_main -->|"creates tab"| node_recycle_ui
node_main -->|"creates tab"| node_prefetch_ui
node_main -->|"creates tab"| node_shim_ui
node_main -->|"creates tab"| node_amcache_ui
node_main -->|"creates tab"| node_srum_ui
node_main -->|"creates tab"| node_mft_ui
node_auto_ui -->|"creates case"| node_case_manager
node_auto_ui -->|"starts collection"| node_auto_collector
node_auto_ui -->|"creates ZIP"| node_packager

click node_main "https://github.com/rasheed-cy/digitalforensicstool/blob/main/main.py"
click node_auto_ui "https://github.com/rasheed-cy/digitalforensicstool/blob/main/gui/auto_gui.py"
click node_viewer_ui "https://github.com/rasheed-cy/digitalforensicstool/blob/main/gui/viewer.py"
click node_jump_ui "https://github.com/rasheed-cy/digitalforensicstool/blob/main/jumplists/jl_gui.py"
click node_recycle_ui "https://github.com/rasheed-cy/digitalforensicstool/blob/main/recyclebin/rb_gui.py"
click node_prefetch_ui "https://github.com/rasheed-cy/digitalforensicstool/blob/main/prefetch/pf_gui.py"
click node_shim_ui "https://github.com/rasheed-cy/digitalforensicstool/blob/main/shimcache/sc_gui.py"
click node_amcache_ui "https://github.com/rasheed-cy/digitalforensicstool/blob/main/amcache/am_gui.py"
click node_srum_ui "https://github.com/rasheed-cy/digitalforensicstool/blob/main/srum/srum_gui.py"
click node_mft_ui "https://github.com/rasheed-cy/digitalforensicstool/blob/main/mft/mft_gui.py"
click node_thumb_parser "https://github.com/rasheed-cy/digitalforensicstool/blob/main/core/parser.py"
click node_jump_parser "https://github.com/rasheed-cy/digitalforensicstool/blob/main/jumplists/jl_parser.py"
click node_recycle_parser "https://github.com/rasheed-cy/digitalforensicstool/blob/main/recyclebin/rb_parser.py"
click node_prefetch_parser "https://github.com/rasheed-cy/digitalforensicstool/blob/main/prefetch/pf_parser.py"
click node_shim_parser "https://github.com/rasheed-cy/digitalforensicstool/blob/main/shimcache/sc_parser.py"
click node_amcache_parser "https://github.com/rasheed-cy/digitalforensicstool/blob/main/amcache/am_parser.py"
click node_srum_parser "https://github.com/rasheed-cy/digitalforensicstool/blob/main/srum/srum_parser.py"
click node_mft_parser "https://github.com/rasheed-cy/digitalforensicstool/blob/main/mft/mft_parser.py"
click node_case_manager "https://github.com/rasheed-cy/digitalforensicstool/blob/main/collector/case_manager.py"
click node_auto_collector "https://github.com/rasheed-cy/digitalforensicstool/blob/main/collector/auto_collector.py"
click node_hasher "https://github.com/rasheed-cy/digitalforensicstool/blob/main/collector/hasher.py"
click node_reporter "https://github.com/rasheed-cy/digitalforensicstool/blob/main/collector/report_generator.py"
click node_packager "https://github.com/rasheed-cy/digitalforensicstool/blob/main/collector/packager.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_main,node_auto_ui,node_viewer_ui,node_jump_ui,node_recycle_ui,node_prefetch_ui,node_shim_ui,node_amcache_ui,node_srum_ui,node_mft_ui toneBlue
class node_thumb_parser,node_jump_parser,node_recycle_parser,node_prefetch_parser,node_shim_parser,node_amcache_parser,node_srum_parser,node_mft_parser toneAmber
class node_case_manager,node_auto_collector,node_hasher,node_reporter,node_packager toneMint
class node_investigator toneIndigo
```

## Components

### Application interface

- [Desktop app](https://github.com/rasheed-cy/digitalforensicstool/blob/main/main.py): `main.py`
- [Auto collection UI](https://github.com/rasheed-cy/digitalforensicstool/blob/main/gui/auto_gui.py): `gui/auto_gui.py`
- [Thumbnail viewer](https://github.com/rasheed-cy/digitalforensicstool/blob/main/gui/viewer.py): `gui/viewer.py`
- [Jump List viewer](https://github.com/rasheed-cy/digitalforensicstool/blob/main/jumplists/jl_gui.py): `jumplists/jl_gui.py`
- [Recycle Bin viewer](https://github.com/rasheed-cy/digitalforensicstool/blob/main/recyclebin/rb_gui.py): `recyclebin/rb_gui.py`
- [Prefetch viewer](https://github.com/rasheed-cy/digitalforensicstool/blob/main/prefetch/pf_gui.py): `prefetch/pf_gui.py`
- [ShimCache viewer](https://github.com/rasheed-cy/digitalforensicstool/blob/main/shimcache/sc_gui.py): `shimcache/sc_gui.py`
- [Amcache viewer](https://github.com/rasheed-cy/digitalforensicstool/blob/main/amcache/am_gui.py): `amcache/am_gui.py`
- [SRUM viewer](https://github.com/rasheed-cy/digitalforensicstool/blob/main/srum/srum_gui.py): `srum/srum_gui.py`
- [MFT viewer](https://github.com/rasheed-cy/digitalforensicstool/blob/main/mft/mft_gui.py): `mft/mft_gui.py`

### Artifact analysis

- [Thumbcache parser](https://github.com/rasheed-cy/digitalforensicstool/blob/main/core/parser.py): `core/parser.py`
- [Jump List parser](https://github.com/rasheed-cy/digitalforensicstool/blob/main/jumplists/jl_parser.py): `jumplists/jl_parser.py`
- [Recycle Bin parser](https://github.com/rasheed-cy/digitalforensicstool/blob/main/recyclebin/rb_parser.py): `recyclebin/rb_parser.py`
- [Prefetch parser](https://github.com/rasheed-cy/digitalforensicstool/blob/main/prefetch/pf_parser.py): `prefetch/pf_parser.py`
- [ShimCache parser](https://github.com/rasheed-cy/digitalforensicstool/blob/main/shimcache/sc_parser.py): `shimcache/sc_parser.py`
- [Amcache parser](https://github.com/rasheed-cy/digitalforensicstool/blob/main/amcache/am_parser.py): `amcache/am_parser.py`
- [SRUM parser](https://github.com/rasheed-cy/digitalforensicstool/blob/main/srum/srum_parser.py): `srum/srum_parser.py`
- [MFT parser](https://github.com/rasheed-cy/digitalforensicstool/blob/main/mft/mft_parser.py): `mft/mft_parser.py`

### Case collection

- [Case manager](https://github.com/rasheed-cy/digitalforensicstool/blob/main/collector/case_manager.py): `collector/case_manager.py`
- [Auto collector](https://github.com/rasheed-cy/digitalforensicstool/blob/main/collector/auto_collector.py): `collector/auto_collector.py`
- [Evidence hasher](https://github.com/rasheed-cy/digitalforensicstool/blob/main/collector/hasher.py): `collector/hasher.py`
- [Report generator](https://github.com/rasheed-cy/digitalforensicstool/blob/main/collector/report_generator.py): `collector/report_generator.py`
- [ZIP packager](https://github.com/rasheed-cy/digitalforensicstool/blob/main/collector/packager.py): `collector/packager.py`

### Other components

- **Investigator**

## Connections

- Investigator → Desktop app: opens
- Desktop app → Auto collection UI: creates tab
- Desktop app → Thumbnail viewer: creates tab
- Desktop app → Jump List viewer: creates tab
- Desktop app → Recycle Bin viewer: creates tab
- Desktop app → Prefetch viewer: creates tab
- Desktop app → ShimCache viewer: creates tab
- Desktop app → Amcache viewer: creates tab
- Desktop app → SRUM viewer: creates tab
- Desktop app → MFT viewer: creates tab
- Auto collection UI → Case manager: creates case
- Auto collection UI → Auto collector: starts collection
- Auto collection UI → ZIP packager: creates ZIP