How sundeep-codes/major_project works
ForensicGuard is a Windows endpoint forensics and security-monitoring application. Its main workflow starts endpoint monitors, records activity for later investigation, then supports risk assessment and ML-based suspicious-behavior detection; users can inspect collected events through the GUI. README capabilities are included even where their implementation was not sampled. The sampled main.py starts monitor threads but does not start the event worker, so no queue-to-storage path is asserted; GUI data access and some monitor wiring are documented rather than verified in source excerpts.
Main entry points: main.py Monitor Launcher · logger.py Event Logger · database.py Forensic SQLite · app.py GUI Application
Components 21
Endpoint Collection
- Monitor Launcher
main.py - Process Monitor
monitors/process_monitor.py - Active Window Monitor
monitors/active_window.py - File Monitor
monitors/file_monitor.py - File Transfer Monitor
monitors/file_transfer_monitor.py - USB Monitor
monitors/usb_monitor.py - Security Monitor
monitors/security_monitor.py - Event Logger
utils/logger.py
Forensic Analysis
- Feature Aggregator
features/feature_aggregator.py - ML Detector
detection/ml_detector.py - Random Forest Model
models/forensicguard_rf.pkl - Process Detector
detection/process_detector.py - Risk Engine
detection/risk_engine.py
Evidence Storage
- Forensic SQLite
database/database.py
User Interface
- GUI Application
gui/app.py - Monitor Controller
gui/controller.py - Main Window
gui/main_window.py - Activity Dashboard
gui/dashboard.py - CSV Export
gui
Other components
- Endpoint User
- Windows Endpoint
Connections 33
- Endpoint User → GUI Application: opens dashboard
- Windows Endpoint → Process Monitor: process activity
- Windows Endpoint → Active Window Monitor: window changes
- Windows Endpoint → File Monitor: file activity
- Windows Endpoint → File Transfer Monitor: copy activity
- Windows Endpoint → USB Monitor: device events
- Windows Endpoint → Security Monitor: security events
- Endpoint User → Monitor Launcher: starts monitoring
- Monitor Launcher → Process Monitor: starts thread
- Monitor Launcher → Active Window Monitor: starts thread
- Monitor Launcher → File Monitor: starts thread
- Monitor Launcher → File Transfer Monitor: starts thread
- Monitor Launcher → USB Monitor: starts thread
- Monitor Launcher → Security Monitor: starts thread
- Monitor Launcher → Forensic SQLite: initializes
- Process Monitor → Event Logger: records events
- Active Window Monitor → Event Logger: records events
- File Monitor → Event Logger: records events
- File Transfer Monitor → Event Logger: records events
- USB Monitor → Event Logger: records events
- Security Monitor → Event Logger: records events
- Event Logger → Forensic SQLite: writes events
- Feature Aggregator → Forensic SQLite: reads events
- ML Detector → Feature Aggregator: gets features
- ML Detector → Random Forest Model: classifies with
- Risk Engine → Forensic SQLite: reads recent events
- Risk Engine → Endpoint User: reports assessment
- GUI Application → Main Window: creates window
- Main Window → Monitor Controller: controls monitoring
- Monitor Controller → Monitor Launcher: launches process
- Activity Dashboard → Forensic SQLite: displays events
- Activity Dashboard → CSV Export: exports events
- GUI Application → Activity Dashboard: presents activity