¶ 🕵️♂️ Forensic
The Forensic module allows you to collect and analyze system-level evidence using a dedicated CryEye agent. This tool is ideal for incident response, malware triage, system compromise verification, and forensic data collection.
¶ 🚀 First Steps
- Create a new forensic project — your workspace for scan results.
- Click
Create Projectand enter the project name (required) and description (optional).
- Select your target operating system and architecture (e.g., Windows x64, Linux x86).
- Click
Create— your project will appear in the dashboard.
- Click
Exploreto enter the project interface.
¶ 🧩 Download and Run the Client
Download the Forensic Client directly by clicking Download Client.
Once downloaded, run the client on the target machine.
📝 You will also see a history of all executed scans within the project.
¶ ✅ Creating a Task
Click Create Task to start a forensic job.
¶ Task Types
Choose the type of forensic task:
-
Agent Control
Control and verify client agent behavior.
-
System Control
Check running processes, network status, and overall health.
-
Forensic Data Collection
Gather logs, registry, memory dumps, browser data, and more.
¶ 🔍 Integrated Tools
CryEye Forensic includes multiple specialized DFIR tools:
- AutoLLR – Local log review and report generation
- EvtxHussar – EVTX log parsing
- Hayabusa – Windows Event Log detection
- Live Forensicator – Live system triage
- Trawler – Disk evidence extraction
- Chainsaw – Event log signature detection
- DFIRtriage – Memory and incident collection
🛠️ Additional tools are continuously being integrated into the CryEye Forensic module.