Building VeriTrace: The Beginning of an Open-Source Digital Forensics Framework
When I began my Master of Science in Cybersecurity at Western Governors University, I knew I wanted my capstone project to solve a practical problem in digital forensics rather than simply demonstrate a technical concept.
That idea became VeriTrace.
VeriTrace is an open-source Windows digital forensics framework that explores how cross-artifact consistency analysis can assist investigators in identifying potential indicators of anti-forensic activity. Rather than relying on a single forensic artifact, the framework is designed to compare evidence across multiple Windows artifacts to help improve confidence in investigative findings.
The project is inspired by a challenge many digital forensic examiners encounter during investigations: validating that evidence from different artifact sources tells a consistent story. As adversaries continue to employ anti-forensic techniques such as event log clearing, timestamp manipulation, and artifact deletion, manually correlating evidence can become increasingly time-consuming.
The long-term goal of VeriTrace is not to replace the expertise of a forensic examiner, but to provide a transparent and explainable tool that assists investigators by highlighting inconsistencies that deserve further examination.
Development is currently underway, and I'm excited to share that the first milestone has been completed with the implementation of the initial Windows Event Log (EVTX) parser. The next development milestones include support for Windows Registry and Prefetch artifacts before implementing the framework's rule-based correlation engine.
Alongside development, VeriTrace is also serving as the foundation of my graduate capstone research. The project has already led to conversations within the DFIR community, including opportunities to contribute a future training lab and submit a technical article discussing the research methodology behind the project.
One of my long-term goals is to make VeriTrace freely available to the digital forensics community as an open-source project that researchers, students, and practitioners can use, evaluate, and contribute to.
This is just the beginning of the journey, and I'll be sharing updates as the project continues to evolve.
Thank you for following along!
Learn More:
- GitHub Repository: https://github.com/Gear-I/VeriTrace
- LinkedIn: https://www.linkedin.com/in/dielle-d-350a0b186
About the Author:
Dielle De Noon is an IT Security Administrator, graduate student, and Digital Forensic Analyst (as-needed contractor) with Summit Cyber Forensics. Her interests include Windows digital forensics, incident response, open-source DFIR tooling, mobile forensics, and cybersecurity research.
Comments
Post a Comment