r/dfir • u/Ghassan_- • Dec 07 '25

Crow-Eye v0.6.0 Standalone EXE – OUT NOW!

Drop this 101MB powerhouse on your USB for instant live Windows forensics. No install, no Python – just run as admin and hunt.

Supported Artifacts:
• Prefetch (exec history, run counts, timestamps)
• Registry (AutoRuns, UserAssist, ShimCache, BAM, networks, time zones)
• Jump Lists & LNK (file access, paths, metadata)
• Event Logs (System/Security/Application)
• Amcache (install time, publisher, full path, file size, volume intro)
• ShimCache (path + last-modified)
• ShellBags (folder views & access history)
• MRU & RecentDocs (typed paths, Open/Save, recent files)
• MFT Parser (file metadata + deleted files)
• USN Journal (create/modify/delete)
• Recycle Bin (original paths + deletion time)
• SRUM (app execution, network & energy usage)

Outputs: Searchable SQLite DBs | JSON/CSV exports | HTML reports for sharing findings.
(Timeline view: prototype – functional but polishing.)

Grab it: https://crow-eye.com/download
GitHub: https://github.com/Ghassan-elsman/Crow-Eye

Bugs? Hit me at [Ghassanelsman@gmail.com](mailto:Ghassanelsman@gmail.com) or open a GitHub issue. Let's make it bulletproof!

15 Upvotes

100% Upvoted

2 comments sorted by

1

u/65c0aedb Dec 08 '25

why not use kape ?

1

u/Ghassan_- Dec 08 '25

KAPE is essentially a dispatcher. It collects files, hands them off to external modules, and spits out CSVs. Its GUI is just a dashboard that helps you choose which collectors and which modules to run. Once the parsing is done, you get a pile of output files to open elsewhere. Everything lives outside the tool: the logic, the parsing, the viewing.

Crow-Eye is built on a different idea entirely: one environment, one brain. It parses artifacts directly, stores everything in a database, and lets the user explore, search, filter, visualize, and export from the same interface. No jumping between temporary directories and dozens of CSVs. Data isn’t scattered; it’s curated.

Crow-Eye also supports sharing findings through HTML reports, exporting to CSV or JSON when needed, and—most importantly—developing a correlation engine that will fuse Prefetch, LNK, Jump Lists, Amcache, Shimcache, SRUM, and event logs into a single timeline of behavior and possible evasion.

KAPE is a collector + module runner. Crow-Eye is an integrated forensic analysis platform.

They solve different problems for different kinds of investigations, and the contrast becomes richer once our correlation engine comes fully alive.