ReconX is a simple python digital forensics tool designed for capturing and analyzing network traffic, acquiring and analyzing evidence, performing incident response, and generating comprehensive reports.
-
Network Traffic Capture: Capture network traffic using Scapy, allowing for flexible and customizable packet analysis.
-
Evidence Acquisition: Easily acquire evidence from specified sources and organize it within the case directory.
-
Evidence Analysis: Conduct keyword-based analysis on acquired evidence to identify relevant information.
-
Incident Response: Perform incident response actions and generate incident response reports.
-
Reporting: Generate detailed reports summarizing captured network traffic, evidence details, and incident response actions.
-
Clone the repository:
git clone https://github.com/your-username/ReconX.git cd ReconX
-
Install dependencies:
pip install -r requirements.txt
-
Run the script:
python ReconX.py
-
Capture Network Traffic:
Enter the case directory: Case123 Enter the source evidence path: C:\path\to\evidence.txt Enter the keyword to search: suspicious_keyword
-
Acquire Evidence:
- Source evidence is copied to the
Case123/Evidence
directory.
- Source evidence is copied to the
-
Analyze Evidence:
- Keyword-based analysis is performed on the acquired evidence.
-
Incident Response:
- Incident response actions are taken, and a report is generated.
-
Generate Report:
- A detailed report is generated in
ReconX_Report.txt
.
- A detailed report is generated in
Contributions are welcome! If you have suggestions, feature requests, or bug reports, please open an issue or submit a pull request.
This project is licensed under the MIT License - see the LICENSE file for details.
- Scapy - for the powerful packet manipulation capabilities.
- Python - for the scripting language used to develop ReconX.
Bright Spectre
- GitHub: thrive-spectre
- Email: [email protected]