Crow-Eye at a Glance
This map shows everything Crow-Eye can do and the order you'll usually work in — from starting a case, to loading evidence, analysing it, asking the Eye, and producing a report. Click any card (or press Enter) to see what it does, which button opens it, and how to use it.
Tip: click (or tap) any card above for a full explanation. Press Esc to close.
Installation
Crow-Eye is designed to be as portable and low-impact as possible. You can run it directly from source or use the executable.
Video Demonstration
Correlation Engine
The Correlation Engine is the core intelligence of Crow-Eye. It transforms isolated forensic artifacts into a unified investigative narrative.
1. Core Architecture & Terminology
Before configuring your first pipeline, it is essential to understand the two foundational pillars of the Crow-Eye architecture:
Feathers (Data Layer)
High-performance, normalized input data. Crow-Eye is tool-agnostic; while it has internal parsers, Feathers can be created from any external tool output (CSV, JSON, SQLite), such as Eric Zimmerman’s suite (PECmd, AmcacheParser, EvtxECmd).
Wings (Logic Layer)
The forensic rulesets. Wings define how Feathers interact. They dictate correlation boundaries, time windows, evidence scoring, and semantic tagging.
2. The Pipeline Manager
The Pipeline Manager is your initial configuration workspace, divided into case metadata and the data/logic builders.
A. Case Metadata
When running the engine for the first time, it generates a default pipeline based on your initial case identifier. You can update the Case ID, Pipeline Name, and Investigator Name to maintain strict evidentiary organization.
B. Feather Creator (Data Ingestion)
The Feather Creator maps raw artifact outputs into the engine's high-speed query format. If you used Crow-Eye’s internal parsers previously, this step is automated.
- Define Save Location: By default, Crow-Eye routes these to your specific case folders (
correlation_configorcorrelation_feathers). - Select Source: Browse for your CSV, JSON, or SQLite file.
- Note for SQLite: The engine auto-detects artifact types based on file metadata. For multi-table databases, use the dropdown to target specific tables.
- Note for CSV: Ensure you specify the correct delimiter (comma, tab, or semicolon).
- Column Mapping: Use the interactive grid to streamline your data. Select only forensically relevant columns and rename them to match standardized timeline conventions.
- Data Preview & Build: Inspect the row input preview. Once verified, click Import to Feather.
C. Wing Creator (Forensic Rulesets)
Wings dictate the investigative hypothesis. Creating a new Wing involves three primary configuration areas:
| Tab | Description & Best Practices |
|---|---|
| Basic Config | Define correlation settings (target specific apps), set the Time Window for event clustering, and set Anchor Priority for your "source of truth." |
| Scoring | Apply weighted scoring to evidence. Assign weights to individual Feathers based on reliability. Wing-specific scoring overrides global system defaults. |
| Semantic Mapping | Simple Mode: Direct 1-to-1 mapping (e.g., EventID 4624 → Successful Login). Advanced Mode: Construct complex conditional logic using AND / OR operators across multiple Feathers (e.g., Process Name + Destination IP) to apply granular semantic tags. |
3. Execution Engine
The Execution Engine is where your configuration is deployed against the data.
4. The Result Viewer
Interpret your findings through three comprehensive views:
Summary Tab
Statistical overview including total matches, wings deployed, and processing time. Visualizations detail evidence origination (MFT, USN Journal vs. Volatile Logs).
Identity Result Viewer
Hierarchical data display: Identity → Anchor → Evidence. Drill down to raw records and hover over semantic tags for underlying logic tooltips.
Time-Based Result Viewer
Organizes data into chronological blocks (default 3-hour windows). Use the micro-timeline filter to isolate events down to the exact minute of a suspected incident.
Dynamic Linking Engine
In complex digital forensic investigations, analyzing raw artifacts—such as SIDs, MAC addresses, GUIDs, and AmCache SHA-1 hashes—often creates a bottleneck. The Dynamic Linking Engine operates as an automated semantic translator within the Crow-Eye platform. It dynamically enriches your data display by appending human-readable context directly into your analytical tables in real-time.
Strict Forensic Integrity
Your original evidence is sacrosanct. The engine relies on an isolated database (Crow_Intelligence.db). Primary forensic databases (SAM, Prefetch, Amcache, etc.) are never altered or written to.
High-Performance Execution
Enrichment occurs natively at the database level utilizing optimized SQLite ATTACH and LEFT JOIN operations. Even massive datasets load instantly without memory overhead.
Accessing the Interface
- Ensure you have an **active case loaded** within the Crow-Eye platform.
- Navigate to the **Sidebar Menu** on the left-hand side.
- Click the DYNAMIC LINKING module (indicated by the Cyan/Teal icon).
Intelligence Gathering
Extract intelligence from parsed artifacts using built-in or custom rules.
Default Rulesets
- SID → Username: Links user mappings from SAM/Registry.
- MAC → Network Name: Maps routers to SSIDs from WLAN logs.
- ProcessID → Process Name: Resolves raw PIDs to executables.
- EventID → Description: Appends official MS descriptions.
Custom Rule Generation
Define logic for unique artifacts: Select Source DB, Table, Value Column (Raw Data), and Key Column (Human Context).
Bulk IOC Ingestion
Inject external CTI or Indicators of Compromise (IOCs) directly into the matrix.
Execution Steps
- Prepare a
.csvor.jsonfile (Value/Key columns). - Drag & Drop into the ingestion zone.
- Automatic parsing injects data into
Crow_Intelligence.db.
LOCKBIT.EXE [LockBit_v3]. SHA-1 feeds match AmCache's file_id, which Windows stores as 0000 + the file's SHA-1 — Crow-Eye matches either form.
Live Mapping Dashboard
Master view for real-time management of active mappings.
- Search Engine: Rapidly locate values/keys across the DB.
- Contextual View: Review Raw Value, Key, and Intelligence Source.
- Data Management: Delete erroneous mappings or add manual pairs.
- Reporting: Export entire matrix to CSV for case notes.
Conflict Resolution
If conflicting keys exist for one value, the engine concatenates the context: Raw_Hash [Malware_A, Malware_B].
Deploying the Intelligence
Once verified, click the primary "RUN DYNAMIC LINKING" button. The interface will close, and Crow-Eye will automatically refresh forensic views (LNK, USN, Event Logs), enriching data cells instantly.
Failed to Initialize
Ensure an active case is initialized and the platform has write permissions in the case directory to create Crow_Intelligence.db.
Enrichment Not Displaying
Verify the gathering rule corresponds to the active data view (e.g., SID rules only apply to columns designated as SIDs by the backend).
Hashes in Crow-Eye: What Is Hashed, and Why
Several Crow-Eye columns hold something that looks like a file hash but is not one. Confusing them costs time, so this is the full inventory, grouped by what each hash is actually for.
1. Windows-supplied hashes inside artifacts
Windows computes these; Crow-Eye only reads and stores them. This is the only group that can be matched against threat-intelligence feeds, and only one entry in it is a hash of file contents.
| Artifact & field | Algorithm | What it covers | How it works | IOC-matchable |
|---|---|---|---|---|
AmCache file_id |
SHA-1 | The file's contents | Windows records the executable's SHA-1 padded to 44 characters as 0000 + 40 hex digits. Crow-Eye matches the padded and the bare 40-character forms interchangeably, so a feed in either format works. |
Yes |
Prefetch hash |
32-bit SCCA path hash | The path the program ran from | Read from the SCCA header at offset 76 and repeated in the .pf filename (NOTEPAD.EXE-D8414F97.pf). The same binary launched from two directories produces two Prefetch files with different hashes — which is what makes it useful for spotting a program running from an unusual location. |
No — not a content hash |
Jump List AppID |
Windows AppID hash | The application's launch path | The jump list filename is the AppID. Crow-Eye takes it from the filename and resolves it against a bundled Known_AppIDs.csv to fill in AppType and AppDesc, which is how a jump list is attributed to a program. |
No — identifies an app, not a file |
2. Crow-Eye bookkeeping hashes
Computed by Crow-Eye purely to give a row a stable identity. They are never evidence and never describe file contents — entry_hash in particular is a 32-character MD5 that is easily mistaken for an executable's MD5.
| Where | Algorithm | What goes in | Why it exists |
|---|---|---|---|
ShimCache entry_hash |
MD5 | path + last_modified + data_size + cache entry position |
Backs a UNIQUE constraint so re-parsing the same registry hive cannot duplicate rows. Size and position are folded in so two genuine executions that share a timestamp stay distinct. |
Offline Importer and image parsing artifact_id |
MD5, first 16 characters | The artifact's source path | A short, stable record identifier for an artifact discovered during import, so the same file keeps the same id across runs. |
3. Chain-of-custody integrity hashes
Computed by Crow-Eye over each evidence file it collects or imports, so you can show the copy you analysed is the copy that was acquired. All are read in chunks, so an arbitrarily large file never has to fit in memory.
| Where | Algorithm | What it covers | How it works |
|---|---|---|---|
| Artifact collection | MD5 and SHA-256 | Every collected artifact file | Hashed in 8 KB chunks as the file is collected, then written into the collection manifest as md5_hash and sha256_hash alongside the access method and any validation warnings. |
| Offline Importer | SHA-256 | Each imported artifact file | Hashed in 4 KB chunks during import. Optional, because hashing a large image adds time — controlled by the hash-calculation setting. |
| Eye · Imported Evidence | SHA-256 | Each imported database or document | Recorded when external evidence is imported, and re-verifiable on demand from the Imported Evidence panel. |
4. The Eye's EvidenceSeal chain
A different job again: proving what the AI was shown. Each payload sent to the model is sealed, and the seals are chained so a record cannot be altered or removed without breaking the chain.
| Field | Algorithm | How it works |
|---|---|---|
payload_sha256 |
SHA-256 | Taken over the exact bytes the model received, together with the token count, model and context limit. |
hash (the chain link) |
SHA-256 | Computed as SHA-256(prevHash + payload_sha256 + metadata_sha256). The sequence and previous hash advance only on a successful append, so tampering surfaces as a broken chain in the Compliance panel. The documentation covers the full protocol. |
Matching hash IOCs
Only AmCache's file_id carries a hash of file contents, so SHA-1 is the one hash type Crow-Eye can match indicators against. An MD5 feed will not match anything, because no parsed artifact table stores an executable's MD5.
Eye AI Assistant
Active Development Notice: The Eye Assistant is currently in continuous active development. Expect significant changes and new forensic capabilities in upcoming releases.
The Eye Assistant is your AI-powered forensic co-pilot. It allows you to interact with your case data using natural language, making complex investigations faster and more intuitive.
Conversational Triage
Ask questions like "Show me all execution events between 2 PM and 4 PM" or "Find any suspicious network connections from user Ghassan".
Living Reports
As you investigate, Eye builds a real-time report with data tables, charts, and narrative findings that can be exported for final case documentation.
RAG Analysis
Eye uses Retrieval-Augmented Generation to pull in forensic knowledge about specific artifacts, helping you interpret complex registry keys or event logs.
Getting Started with Eye
- Open the Eye Assistant from the main toolbar.
- Configure your Backend: Choose between Cloud APIs (OpenAI/Anthropic) or Local Models (Ollama/LM Studio) in the settings.
- Initialize Case Context: Provide a brief summary of your investigation goal to help Eye focus its analysis.
- Start Investigating: Type your queries in the chat bar. Eye will automatically execute the necessary SQL and search tools.
The Ghassan Elsman Protocol
Eye operates under the GEP — a vendor-neutral standard of 10 principles for how AI should be used in forensics (see the GEP page). Every AI response is anchored in raw evidence, and all internal actions are recorded in a machine-readable audit trail for non-repudiation and chain of custody preservation.
Forensic Toolset
Eye has direct access to several specialized forensic tools:
Investigative
- SQL Querying: Direct access to all artifact databases.
- Global Search: Regex hunting across the entire case.
- Intel Lookup: Live research via LOLBAS and LOLDrivers.
- Correlation Access: Deep integration with the Wing/Feather engine.
Reporting
- Data Tables: Interactive tables with sorting/filtering.
- Charts: Bar, Line, and Pie visualizations.
- Markdown: Rich-text narrative documentation.
- Export: Formal PDF and HTML investigative reports.
Troubleshooting
Encountering issues? Check these common solutions for the most frequent technical hurdles.
Dependency Failures
If PIP fails, retry the command. Network fluctuations can occasionally interrupt the virtual environment initialization.
Permission Denied
Forensic artifacts (MFT, Registry, Event Logs) require high-level access. Always launch the terminal or EXE as **Administrator**.
Smart App Control
Windows may flag the unsigned binary. Click 'More info' -> 'Run anyway'. For permanent access, disable Smart App Control in Windows Security.
- Open **Windows Security**
- Go to **App & browser control**
- Set **Smart App Control** to Off
Running an Investigation — FAQ
The questions that come up between installing Crow-Eye and writing the report.
How do I start a forensic investigation in Crow-Eye?
Create a case, choose whether to collect from the live system or an offline image, then let Crow-Eye parse the artifacts. Everything after that — timeline, correlation, the case narrative — works from that one case folder.
What is the Narrative Map?
The Narrative Map is where a case's findings live: verdicts, the narrative behind each one, and the evidence rows that support them. It is the Eye's working memory for the case and the place your evidence documentation is assembled, so a conclusion is never separated from what it rests on.
How do I document evidence for a report?
Every claim in the Narrative Map links to the database rows it came from, so the report is built from source records rather than retyped. The Compliance panel keeps the matching audit trail of what was read and when.
Can Crow-Eye analyse a forensic image instead of a live machine?
Yes. Crow-Eye parses offline images as well as live systems, using the same parsers, so results from an image and from a live collection are directly comparable.
How long does parsing take?
It depends on the artifacts selected and the size of the volume. Parsers run in parallel and report progress per artifact, and you can start reviewing parsed artifacts before the whole set finishes.
Do I need administrator rights?
Yes, for a live collection. Protected artifacts such as the MFT and the USN journal cannot be read without them. Parsing an offline image does not require elevation.
How do I parse Prefetch, MFT or Registry artifacts with Crow-Eye?
Open a case, then use Live analysis to parse a running system or the Offline Importer for a collected folder or image. You can run every parser at once with Parse all Artifacts, or parse a single artifact type on its own when you only need Prefetch, the MFT, the Registry, Event Logs, AmCache, ShimCache, SRUM, LNK files or Jump Lists.
Can Crow-Eye visualise a forensic timeline?
Yes. Parsed artifacts feed an interactive timeline that threads events by identity - the same file, user or host across sources - so you read a per-entity story rather than a flat list sorted by timestamp. Events can be opened down to the source row they came from.
How do I use the Eye AI assistant?
Open the Eye from the top bar once a case is parsed, and ask in plain language. It queries the case databases with forensic tools rather than guessing, links every claim back to the record it came from, and can run on a cloud model, a local model server, or fully offline.
What do I need to get started with Crow-Eye?
Windows 10 or 11 with administrator rights for a live collection, and a case folder to work in. Install the MSI, open or create a case, collect or import artifacts, and parse them - correlation, the timeline and the Eye all work from that parsed case.
Does Crow-Eye match hash IOCs?
For SHA-1, yes. Crow-Eye matches SHA-1 indicators against AmCache's file_id, which Windows stores as 0000 followed by the file's SHA-1, and it matches either form. MD5 feeds do not match, because no parsed artifact table holds an executable's MD5 - Prefetch's hash column is a hash of the path the program ran from, and ShimCache's entry_hash is an internal deduplication key.