TRANCE
A tool that helps digital forensic investigators automatically work out whether, and how, someone used Tor Browser on a Windows computer, instead of piecing it together by hand.
The problem
General-purpose forensic suites (EnCase, FTK, AXIOM) handle broad file-system and registry browsing but encode no Tor Browser-specific knowledge, so examiners are left to manually correlate scattered registry, disk, and memory artifacts by hand. These are the three layers most likely to survive Tor Browser's privacy-preserving design.
The approach
Built as a CS3400 Cyber Security coursework project with a team, split into three automated modules: registry & execution evidence, disk & database artifacts, and memory analysis (Volatility 3 plus custom YARA signatures), unified by a shared SHA-256 hashing and chain-of-custody layer and merged into a single reproducible HTML/JSON report. My role is the disk & database module: recovering and correlating the Tor Browser evidence left behind in disk artifacts and its internal databases.
Progress so far
Still in development, evaluated against synthetic ground-truth data across live, shutdown, and hibernation capture scenarios. The main challenge so far has been keeping disk-layer findings reconcilable with what the registry and memory modules report for the same timeline.