A Scalable Cross-Platform DFIR Framework for Automated Evidence Collection, Correlation and Cloud Forensic Investigation
When a system is breached, investigators lose hours collecting logs and artifacts by hand from different machines. This framework automates collection across Windows, Linux and cloud environments, correlates the evidence into one timeline, and keeps a verifiable chain of custody.
The research paper passed initial screening at the International Journal of Information and Computer Security (Inderscience) and is now in peer review. Phase I is complete and the implementation is in progress.
View the repositoryHow an investigation flows through it
- CollectPull logs, memory and disk artifacts from each platform
- PreserveHash every item to keep the chain of custody intact
- CorrelateLink events across machines and cloud accounts
- ReportProduce a timeline an investigator can act on