WFCR is a production-grade Digital Forensics and Incident Response (DFIR) engine built to parse, normalize, and correlate disparate Windows execution artifacts into a unified, chronologically ordered master timeline.
Designed for threat hunting and forensic analysis, WFCR automatically stitches together fragmented data from the Master File Table (MFT), System Resource Usage Monitor (SRUM), Shimcache, and Background Activity Moderator (BAM/DAM) to reveal hidden execution chains, timestomping, and ghost-file execution.
- Multi-Artifact Correlation: Intelligently merges overlapping execution data from multiple OS subsystems to rebuild complete attack lifecycles.
- Advanced Anomaly Detection:
- Timestomping Identification: Compares
$STANDARD_INFORMATION(SI) and$FILE_NAME(FN) attributes in the MFT to flag manipulated timestamps. - Ghost-File Execution: Detects execution evidence in Shimcache/BAM for payloads that have been securely wiped from the disk.
- Timestomping Identification: Compares
- User SID Attribution: Resolves User SIDs dynamically via the
SruDbIdMapTableto attribute network exfiltration and process execution to specific accounts. - Resilient Parsing Architecture: Implements graceful degradation for native Windows binaries (e.g.,
libesedb/pyesedb), ensuring pipeline stability across cloud environments and lightweight triage setups.
The core correlation engine aggregates and synthesizes data generated by the following internal parsers:
| Parser | Artifact Location | Forensic Value |
|---|---|---|
| MFT | C:\$MFT |
File creation/modification, SI/FN timestomping detection. |
| Shimcache | SYSTEM Registry Hive |
Evidence of historical executable execution and file path existence. |
| BAM / DAM | SYSTEM Registry Hive |
Post-boot execution tracks and desktop activity lifecycle. |
| SRUM | SRUDB.dat |
Historical network data usage (Bytes Sent/Received) mapped to AppIDs and SIDs. |
WFCR is built using modern Python packaging standards (pyproject.toml). It can be installed as an editable global CLI tool.
# 1. Clone the repository
git clone https://github.com/KrishnenduOfficial/winforensics-correlator.git
cd winforensics-correlator
# 2. Install the package and dependencies
pip install -e .