Alvindag/cyber-forensics-toolkit-

🔐 Integrated digital forensics platform — CFEMS (evidence management + chain of custody) and CIRG (incident report generator). NIST SP 800-61 · ACPO · Ghana CSA 2020 compliant. Built with Flask + PostgreSQL. # 🔐 Cyber Forensics Toolkit ### CIRG · CFEMS — Integrated Digital Forensics & Incident Response Platform --- A two-application integrated platform for **digital forensic evidence management** and **cyber incident report generation**, built for IT security practitioners, SOC analysts, and digital forensics investigators. Both tools share a single PostgreSQL database (`cfems`) and are designed to work together — CIRG pulls live case and evidence data directly from CFEMS, ensuring every incident report is backed by properly managed forensic evidence. --- ## 🗂️ Applications | App | Port | Description | |---|---|---| | **CFEMS** | `5000` | Cyber Forensic Evidence Management System — chain of custody, case management, evidence hashing | | **CIRG** | `5001` | Cyber Incident Report Generator — six-step wizard, PDF report output, live CFEMS integration | --- ## 📸 Screenshots > _See the `/screenshots` folder for full UI previews._ | CFEMS — Evidence Dashboard | CIRG — Incident Wizard | CIRG — PDF Report Output | |---|---|---| | | | | --- ## 🔬 CFEMS — Cyber Forensic Evidence Management System **Port:** `5000` | **Stack:** Flask · PostgreSQL · Flask-Login CFEMS provides a structured, audit-ready environment for managing digital evidence throughout an investigation or incident lifecycle. ### Key Features - **Case Management** — Create and track cases with unique reference numbers (`CFEMS-YYYY-0001`) - **Evidence Register** — Log evidence with SHA-256/MD5 hash values for integrity verification - **Chain of Custody** — Full audit trail of every access, transfer, and action on each evidence item - **Evidence Type Classification** — Supports PCAP files, disk images, log files, documents, email exports, and more - **File Upload** — Attach evidence files directly to records with server-side storage - **Role-Based Access** — Investigator and admin roles with full audit logging - **API Endpoints** — RESTful API consumed by CIRG for live evidence pulling # …