SecuForensix is a Windows forensics tool designed to automate evidence collection for investigators and incident responders. It captures system logs, recent user activity, network data, and optionally Android-related artifacts via ADB, storing everything in timestamped forensic reports.
- Collects Windows Event Logs (System, Application, Security)
- Retrieves UserAssist data (program usage history)
- Extracts recently executed commands and netstat connections
- Automatically downloads and configures ADB for Android forensics if needed
- Generates timestamped forensic folders at
C:\ForensicReports\ - Uses color-coded PowerShell output for better readability
- Fully portable
.batscript – no installation required
-
Windows OS with:
cmd.exePowerShell
-
Administrator privileges (required for accessing logs, registry, and networking info)
-
Internet connection (only required if ADB needs to be downloaded)
- Download the script file:
win.bat - Place it anywhere on your system
- Right-click the script and choose Run as Administrator
-
On execution, SecuForensix:
- Initializes PowerShell-based status messages
- Creates a timestamped directory inside
C:\ForensicReports\ - Checks for ADB, and downloads it if missing
-
Performs forensic collection using commands like:
-
wevtutilfor logs:wevtutil qe System /c:30 /f:text > system_logs.txt
-
netstatfor active connections:netstat -ano > netstat.txt
-
Registry dumps for UserAssist keys (recent program usage):
Get-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\* > userassist.txt
-
-
Results are saved in a folder named like:
C:\ForensicReports\Fri_05_02_2025_17-45-10\
Inside the report folder, you’ll find:
| File Name | Description |
|---|---|
system_logs.txt |
Last 30 system events via wevtutil |
application_logs.txt |
Last 30 application events |
security_logs.txt |
Last 30 security logs |
netstat.txt |
Snapshot of TCP/UDP/Listening connections |
userassist.txt |
Program usage via UserAssist registry keys |
adb_devices.txt |
(If ADB enabled) connected Android devices |
- ADB not found? Script will automatically fetch it from the official Android source.
- Permission denied? Ensure you're running the
.batfile as an administrator. - No output generated? Check if the script was blocked by antivirus or run from a protected directory.
MIT License – see LICENSE for full details.
Created by Kashish Kanojia During GPCSSI 2024 – Gurugram Police Cyber Security Summer Internship
Received a Letter of Recommendation from Dr. Rakshit Tandon for outstanding performance in cyber forensics.
- 🌐 Website
- 💻 GitHub
- 🐦 X
- 📧 [email protected]
Visit the official SecuForensix Website for more details about the tool.
"Dedicated to advancing cybersecurity through innovative forensic tools and education."