Forensa Tools v4 — A DFIR Platform Built for Live Incident Response When a cyber incident strikes…
KENNEDY A. — Cybersecurity Analyst
Forensa Tools v4 — A DFIR Platform Built for Live Incident Response
When a cyber incident strikes, organisations are often forced into an impossible decision:
shut systems down to investigate, or continue operating without visibility.
Both options come at a cost. Financial loss, reputational damage, and operational disruption.
Forensa Tools v4 is being built to remove that trade-off.
"A forensic investigation platform designed to operate alongside live business environments, not replace them. Analysts can investigate, correlate, and understand attack activity in parallel with ongoing operations, without touching production systems."
Core Capabilities
EVTX and Event Log Analysis
High-speed ingestion and parsing of Windows Event Logs
Full field extraction and normalization
Designed for large-scale correlation and investigation workflows
Sigma Detection Engine
4,900 plus Sigma rules executed in real time via Hayabusa, Rust-powered
Built-in severity classification
MITRE ATT&CK mapping for threat context
Impact scoring to prioritise critical findings
File and Malware Analysis
Supports PE executables, Office macros, scripts, PDFs, phishing emails, and archives
Integrated YARA scanning
Deobfuscation capabilities for deeper inspection
CVE and Vulnerability Scanning
Offline vulnerability pattern library
Integrated with NVD API v2 and CIRCL.LU, no API key required
Detects major vulnerabilities including Follina, EternalBlue, Log4Shell, and PrintNightmare
SANS Artifact Collection
Aligned with the Windows Forensic Analysis Poster:
Prefetch
Shimcache
Amcache
Shellbags
LNK files and Jump Lists
Master File Table, MFT
Recycle Bin artifacts
Browser Forensics
Supports Chrome, Edge, Firefox, and Brave:
Browsing history and downloads
Search activity
Cookies and saved credentials
CertUtil cache analysis for LOLBin detection
EZ Tools Integration
Native integration with Eric Zimmermann’s forensic suite:
EvtxECmd, PECmd, JLECmd, MFTECmd, AmcacheParser
Parallel execution with structured CSV output
Unified Timeline and Reporting
Correlates EVTX, MFT, LNK, and Prefetch data into a single timeline
Export formats: JSON, CSV, HTML
Designed for both technical analysis and executive reporting
Why This Matters for Business Continuity
No Forced Downtime
Investigations run on collected evidence files, not live systems. Business operations continue without interruption.
Rapid Triage in Minutes
A one-click Full Triage executes all modules in parallel, providing immediate situational awareness.
Analyst-Centric Design
Impact scoring highlights what matters most
MITRE ATT&CK mapping adds context
Click-through detail panels reduce investigation time
Evidence-Grade Reporting
Outputs are structured for incident response documentation, legal review, and regulatory disclosure
Technology Stack
Desktop: Electron, Windows
Frontend: React and Vite
Backend: Python FastAPI
Detection Engine: Hayabusa, Rust
Analysis Libraries: pefile, oletools, yara-python
Threat Data: NVD API v2, CIRCL.LU
Forensic Tooling: EZ Tools, Eric Zimmermann
Detection Rules: 4,900 plus Sigma and Hayabusa rules
Optional Integration: VirusTotal API
Current Status: Validation Phase
Forensa Tools v4 is currently being tested and validated across real-world forensic and incident response scenarios.
Planned Enhancements
Memory forensics integration
Network traffic and PCAP analysis
Threat intelligence enrichment
4 reactions · 2 comments
Comments
Laurent H.: Really interesting to see a platform built around the "no forced downtime" principl, that tension between investigation and continuity is something IR teams deal with constantly, and it's often where the real operational pain sits.
KENNEDY A.: Laurent Halimi Appreciate that. It is one of the biggest gaps in current IR workflows. Investigation and continuity are still treated as competing priorities when they should be able to coexist. That is the problem I am trying to solve with this platform.