Ghassan-elsman / Crow-Eye
Windows forensics Engine
Why this job: matched by what the repo talks about: engine, window
What it does
- Reconstruction over detection. Correlates every artifact into one navigable, per-entity story instead of a pile of alerts.
- Integrated end to end. acquisition → correlation → timeline → behavioral analytics → AI → sealed case memory: a full pipeline no single incumbent tool spans.
- Artifact-deep, not log-shallow. Prefetch, Amcache, ShimCache, SRUM, MFT, USN, LNK/JumpLists and more survive the log clearing and "living-off-the-land" tricks that blind log-only tools.
- The Eye AI assistant. natural-language forensic investigation with an auditable, tamper-evident chain of custody, runnable in the cloud, on a private server, or fully offline.
- User Behavior Analytics (UBA). turns raw artifacts into a plain-English, HR/examiner-readable activity story.
Get started
No single install command. Read the steps in the README (opens in new tab)
- Maintenance
- Active
- Last commit 3 days ago
- Stars
- 119
- +2 this week
- Licence
- GPL-3.0
- Share-alike terms
- Downloads for
- None listed
- No release files
- Latest version
- 0.15.0
- Released 10 days ago
- Built with
- Python
- 96% of the code
Is it looked after?
- Contributors
- 1
- Last 90 days
- Issues
- 100% closed
- 0 still open
- Pull requests
- 1 merged
- 0 waiting
- Releases
- 24
- 25 in the last year
- Contributing guide (opens in new tab)
- No security policy
- No code of conduct
More: languages, topics, project record and preview image
Languages
- Python 96%
- JavaScript 2%
- TypeScript 1%
- CSS 1%
Topics
- ai-agents
- ai-forensics
- crow-eye
- forensics
- forensics-data
- forensics-tools
- identity-engine
- logs
- mft
- mru
- prefetch
- registry
Project record
- JobLocal LLMs
- StatusListed
- Commits188
- Forks12
- Watching4
- Stars in 28 days+5
- CreatedDec 19, 2024
- First seen by usNov 7, 2026
- CheckedNov 10, 2026