CP-DFIR: A Scalable Cross-Platform DFIR Framework for Automated Evidence Collection, Correlation and Cloud Forensic Investigation
When a system is breached, investigators lose hours collecting logs and artifacts by hand from different machines. CP-DFIR collects evidence from Windows, Linux and AWS automatically, converts it to one common schema and correlates it into a single attack timeline using 57 MITRE ATT&CK-mapped rules.
Every step is written to a tamper-evident, HMAC-signed chain-of-custody ledger. In testing it detected 25 out of 25 simulated evidence-tampering attempts.
How an investigation flows through it
- CollectPull logs, memory and disk artifacts from each platform
- PreserveHash every item to keep the chain of custody intact
- CorrelateLink events across machines and cloud accounts
- ReportProduce a timeline an investigator can act on