ForensiCore: A Forensic Evidence Intelligence System

ForensiCore is a web-based platform for managing digital forensic evidence with integrity, traceability, and incident intelligence in mind. It helps security and investigation teams ingest logs, maintain chain-of-custody records, map evidence to controls, and generate incident-focused reports.

Why ForensiCore?

Digital investigations need more than file storage. They need:

• Evidence integrity verification
• End-to-end chain of custody
• Correlation between incidents and supporting artifacts
• Audit-friendly reporting
• Security control mapping for compliance context

ForensiCore is designed to bring these capabilities into one focused system.

Current Features

• Evidence ingestion with file upload support
• SHA-256 evidence hash generation
• Confidence scoring and confidence labels for evidence
• Chain-of-custody record tracking
• Immutable-style linked ledger hashing
• Incident creation and evidence linking
• Control mapping to evidence
• Incident report generation
• Graph visualization of evidence relationships
• Demo seed command for realistic forensic datasets

Planned Features

• Role-based access control and authentication hardening
• Evidence verification workflow and tamper alerts
• Advanced filtering, search, and timeline views
• API endpoints for SIEM/EDR ingestion
• Exportable PDF/JSON reports
• Test suite expansion and CI pipelines
• Containerized deployment profiles

Tech Stack

• Python
• Django
• SQLite (current default)
• Bootstrap 5
• NetworkX and Matplotlib (relationship graphing)

Screenshots

Getting Started

1. Clone the repository

git clone https://github.com/<your-username>/forensic-evidence-system.git
cd forensic-evidence-system/core

2. Create and activate a virtual environment

python -m venv .venv
source .venv/bin/activate

3. Install dependencies

pip install django networkx matplotlib

4. Apply migrations

python manage.py migrate

5. (Optional) Seed demo forensic data

python manage.py seed_data

6. Run the server

python manage.py runserver

Open your browser at:

http://127.0.0.1:8000

Core Workflow

• Ingest evidence from security systems
• Auto-generate evidence hash and baseline confidence
• Create incidents and link relevant evidence
• Map evidence to security controls
• Track custody and ledger events
• Generate investigation reports and view relationship graphs

Data Entities

• Evidence
• Incident
• Custody
• Ledger
• Control

Roadmap

• Improve model validation and error handling
• Add robust automated tests
• Add pagination for large evidence sets
• Improve graph readability for dense incident datasets
• Introduce API-first ingestion pipeline

Contributing

Contributions, issue reports, and suggestions are welcome.

• Fork the repository
• Create a feature branch
• Commit your changes
• Open a pull request with a clear summary

License

This project is licensed under the MIT License.