The orchestrator layer is what makes this workable for an agent: "was mimikatz.exe executed?" is one call that correlates Prefetch, Amcache and SRUM into a verdict with the evidence attached, rather than three separate parses and a judgement the model has to make on its own. Underneath, every parser is pure Python — no Windows box and no Eric Zimmerman binaries needed, though their CSV output can be imported if you already have it.
A Windows forensics toolkit that runs entirely on Linux with no Windows tooling. It parses event logs, registry hives, the MFT and USN journal, prefetch, Amcache, SRUM, browser history, LNK files and ShellBags in pure Python, and adds PCAP analysis, YARA scanning, VirusTotal lookups and API Monitor capture analysis on top.
- Orchestrators that answer the question rather than the artifact: was this binary executed (Prefetch, Amcache, SRUM), what did the user do (Browser, ShellBags, LNK, RecentDocs), find this IoC everywhere, build one timeline
- Event logs listed, counted, and searched by time, Event ID and keyword, with pre-built security searches, a compact TSV triage summary, and Event ID explanations
- Registry hives read: a key and its values, pattern search, Run keys and services, SAM accounts, USB history, OS version and network configuration
- File system artifacts: $MFT with ADS metadata and timestomping detection, and the $J USN journal for file operations and deleted files
- Execution evidence: prefetch run counts and loaded files, Amcache SHA1s and first-seen timestamps, SRUM application resource and network usage, and static PE analysis with MD5, SHA1, SHA256 and imphash, imports, exports and packer detection
- User activity: Edge, Chrome and Firefox history and downloads, LNK targets, and ShellBags from both UsrClass.dat and NTUSER.DAT, including UNC shares and browsed archive interiors
- PCAP and PCAPNG analysis: statistics and top talkers, conversations, DNS, HTTP requests, payload search, and detection of C2 indicators, beaconing and DNS tunnelling
- API Monitor .apmx64 and .apmx86 captures parsed: calls filtered and paged, parameter values, attack patterns with MITRE ATT&CK IDs, handle producer/consumer chains, and enriched injection detail — target PID, shellcode size, technique
- A Windows API knowledge base of 26,944 definitions with parameter signatures, DLL mappings and category browsing, plus PE import analysis mapped to ATT&CK
- YARA scanning of a file or a directory with 718 rules from signature-base, and behavioural IoC packs including a 65-rule impacket set
- VirusTotal reputation for hashes, IPs, domains and files, with caching and rate limiting
- Packer, compiler and protector detection through Detect It Easy, including how hard a given packer is to unpack
- Artifacts collected from a live host over WinRM, by password or pass-the-hash
- Eric Zimmerman CSV output imported — MFTECmd, PECmd, AmcacheParser, SrumECmd
Python 3.10 or newer on Linux, installed with uv tool install winforensics-mcp, or from source with the [all] extra for every optional parser. VirusTotal lookups need VIRUSTOTAL_API_KEY or the key in ~/.config/winforensics-mcp/vt_api_key; the free tier allows 4 requests a minute, which the client paces, caching results for 24 hours. Packer detection needs Detect It Easy installed separately. No Windows machine and no Windows tooling is involved at any point. The repository also ships a CLAUDE.md worth copying into the case directory — it steers the model to the orchestrators before the low-level parsers.
One command plus a key — uv tool install winforensics-mcp, then supply credentials