CaYa Network Forensic Observer

Version 1.0.0 · Windows forensic network observation and evidence collection toolkit.

CaYa Network Forensic Observer is a Windows-focused forensic utility for recording network activity, process/socket telemetry, selected ETW/WFP diagnostics, and optional HTTP(S) proxy evidence into structured local session folders. It uses Windows' built-in Pktmon for packet capture, so Wireshark and Npcap are not required for collection.

Authorized use only: Captures may contain passwords, tokens, cookies, URLs, uploaded files, request/response bodies, process paths, usernames, and other sensitive data. Use this software only on systems you own or are explicitly authorized to test or investigate.

Türkçe README

Highlights

• System-wide packet capture through Windows Pktmon
• Raw ETL forensic copy, bounded circular capture, and PCAPNG conversion
• WFP forensic capture
• Best-effort ETW collection for DNS, TCP/IP, Schannel, WinINet, WinHTTP, process, file, and registry providers
• Process create/exit telemetry with PID, PPID, parent, executable path, command line, creation time, and username where available
• Socket-to-process snapshots and best-effort flow/process correlation
• Optional HTTP/HTTPS proxy logging with request methods, URLs, headers, bodies, multipart extraction, and WebSocket message metadata
• TLS metadata such as SNI, TLS version, ALPN, cipher, and certificate metadata when visible
• Offline DNS, TLS ClientHello, cleartext HTTP, UDP/443 QUIC classification, and flow analysis
• Unified timeline combining process, DNS, TLS, HTTP, and network events
• Before/after inventory snapshots for Scheduled Tasks, Services, and Run/RunOnce autoruns
• Automatic restoration of proxy/WinHTTP settings changed by the application
• Emergency recovery helper for interrupted sessions
• English and Turkish user interface

Language behavior

The application automatically follows the Windows user language:

• Turkish Windows (tr) → Turkish UI
• All other or unknown languages → English UI

For testing, the detected language can be overridden before launch:

set CAYA_NFO_LANGUAGE=tr
python observer.py

or:

set CAYA_NFO_LANGUAGE=en
python observer.py

English is always the fallback language.

Requirements

• Windows 10 or Windows 11
• Python 3.10 or newer recommended
• Administrator privileges for Pktmon, WFP, and machine-level WinHTTP capture features
• Internet access during first launch if Python dependencies are not already installed

Python dependencies are listed in requirements.txt.

Quick start

1. Download or clone the repository.
2. Run run_windows.cmd.
3. Read and accept the in-app security acknowledgement.
4. Select only the capture layers you need.
5. Use Restart as administrator when enabling features that require elevation.
6. Start monitoring.
7. Stop the session from the application so temporary settings can be restored and post-processing can complete.

run_windows.cmd creates a local .venv, installs dependencies, and opens the GUI. Its console text also follows the Windows language when Turkish is detected; otherwise it uses English.

Capture output

Each session is written locally under:

logs/session_YYYYMMDD_HHMMSS/
├── session_meta.json
├── observer.log
├── process_events.jsonl
├── connections.jsonl
├── raw/
│   ├── pktmon*.etl
│   └── wfpdiag...
├── http/
│   ├── events.jsonl
│   ├── bodies/
│   └── multipart/
├── inventory/
│   ├── *_before.*
│   ├── *_after.*
│   └── diff.json
└── analysis/
    ├── capture_*.pcapng
    ├── pktmon_*.txt
    ├── etw_*.csv
    ├── flows.jsonl
    ├── dns.jsonl
    ├── tls.jsonl
    ├── quic_udp443.jsonl
    ├── clear_http.jsonl
    ├── http_network_links.jsonl
    ├── unified_timeline.jsonl
    └── summary.json

session_meta.json includes the application version and the UI language used for that session.

HTTPS visibility and technical limits

Pktmon records packets at the system/network level, but encrypted TLS payload remains encrypted in packet captures.

Optional plaintext HTTP(S) visibility relies on a local mitmproxy-based proxy and, when explicitly enabled, a local test CA trusted by the Windows system. This only affects clients that actually use the configured proxy and accept that CA.

This project does not implement bypasses for certificate pinning, ECH, custom trust stores, proxy bypass behavior, or similar application security controls. Such traffic may remain encrypted or invisible to the proxy layer.

Sensitive data handling

By default, selected sensitive HTTP headers such as authorization and cookie headers are redacted by the proxy addon. The GUI contains an explicit option to store them unredacted; enabling it can materially increase the sensitivity of generated evidence.

Captured files are stored locally and are not automatically uploaded by this project. Review session folders before sharing logs, opening public GitHub issues, or attaching captures to bug reports.

Recovery

If the application or Windows session ends unexpectedly, run:

emergency_restore.cmd

The helper attempts to stop capture state associated with an active CaYa Network Forensic Observer session and restore saved WinHTTP/user proxy settings.

Repository layout

observer.py            Main Tkinter application and capture orchestration
i18n.py                English/Turkish localization and system-language detection
mitm_addon.py          mitmproxy HTTP(S)/WebSocket evidence addon
analyze_capture.py     Offline PCAPNG/network analysis
inventory_diff.py      Before/after persistence inventory comparison
run_windows.cmd        Windows launcher and environment bootstrap
emergency_restore.cmd  Recovery helper
requirements.txt       Python dependencies
VERSION                Application version

Security

Please do not publish vulnerability details, sensitive captures, tokens, cookies, or private forensic evidence in a public issue. See SECURITY.md for the vulnerability reporting policy.

Contributing

Contributions are welcome. See CONTRIBUTING.md before submitting a pull request.

License

Licensed under the MIT License.

Copyright © 2026 Çağan Turgut / CaYaDev.