by Dielle De Noon, M.S.
Abstract
This article presents the design and development of Corrobora, an open-source Windows digital forensics framework built as part of a Master of Science in Cybersecurity capstone at Western Governors University. Unlike tools that examine forensic artifacts in isolation, Corrobora is designed to compare evidence across multiple independent Windows artifact sources to identify inconsistencies that may warrant further investigation. This article covers the first two milestones of the project: the Windows Event Log (EVTX) parser and the Windows Registry parser. It discusses the motivation for each component, the shared design philosophy that guided their development, the technical challenges encountered, and how both parsers lay the groundwork for Corrobora’s planned cross-artifact correlation engine.
Introduction
Every digital forensic investigation begins with a fundamental question: what happened on this system? Answering that question requires investigators to collect, analyze, and validate evidence from multiple sources while ensuring their conclusions are based on reliable and defensible data. Windows systems generate a vast amount of forensic evidence, and two of the most valuable sources available to investigators are the Windows Event Log (EVTX) and the Windows Registry.
Windows Event Logs provide a chronological record of operating system activity, authentication events, application behavior, security auditing, service execution, and countless other events that help investigators reconstruct system activity. The Windows Registry, by contrast, serves as the operating system’s central configuration database, preserving information about installed software, user preferences, hardware devices, startup locations, and other configuration details that often remain available long after an event occurs.
As part of my capstone research, I am developing Corrobora, an open-source Windows digital forensics framework focused on cross-artifact consistency analysis. Rather than examining forensic artifacts independently, Corrobora compares evidence across multiple Windows artifact sources to identify inconsistencies that may warrant further investigation. The EVTX parser and the Registry parser are the first two major milestones of the project, and together they establish the engineering patterns and forensic principles that will guide the rest of the framework’s development.
Why Is This Important
Whether investigating ransomware, insider threats, unauthorized access, or policy violations, EVTX files frequently provide some of the earliest and most valuable evidence available in a Windows investigation. Event Logs exist on nearly every Windows installation, document activity across numerous Windows components, and provide chronological information that becomes valuable when constructing investigative timelines. Critically, Event Logs frequently contain evidence that can later be validated using independent artifacts, making them an ideal starting point for cross-artifact consistency analysis.
The Registry complements this record. From a digital forensics perspective, Registry artifacts can help answer questions such as what software is installed on a system, what programs are configured to start automatically, what user accounts have interacted with the computer, what system settings have changed, and which devices have previously been connected. Although the Registry rarely provides every answer by itself, it often provides valuable context when combined with other forensic artifacts, including Event Logs.
Most existing forensic tools already do an excellent job parsing either Event Logs or the Registry individually. What is largely missing is an open, transparent framework that treats these artifacts as pieces of a larger, correlated picture rather than as standalone evidence sources — which is the gap Corrobora is designed to address.
What Is the Problem
Digital forensic investigations are built upon evidence, not individual artifacts. Yet many forensic workflows still treat artifacts such as Event Logs and the Registry as separate, independently analyzed sources of evidence, rather than as parts of a larger evidentiary picture. When artifacts are examined only in isolation, opportunities to validate findings — or to notice when evidence is unexpectedly missing or contradictory — can be lost.
The problem Corrobora addresses is twofold: first, there is no lightweight, open-source framework purpose-built to standardize evidence extracted from different Windows artifacts into a common format suitable for comparison; second, without such standardization, identifying inconsistencies between artifacts (for example, an application that appears to have run according to one artifact but shows no corroborating trace in another) remains a manual, ad hoc process. Solving this problem starts with building reliable, standardized parsers for individual artifacts — beginning with Event Logs and the Registry — before a correlation engine can be layered on top.
Core
One of the primary goals of Corrobora is transparency: rather than producing opaque results, every stage of processing should be understandable, reproducible, and explainable. Both the EVTX parser and the Registry parser were developed around the same set of guiding principles.
- Read-Only Processing. Digital forensic tools should never modify evidence. Both parsers only read their respective source files (Event Logs and offline Registry hives) and perform no operations that alter their contents. This preserves the integrity of the evidence and aligns with accepted forensic practices.
- Standardized Output. Windows Event Logs contain thousands of different event types generated by hundreds of providers, and Registry hives contain many different data structures depending on the hive being examined. Despite these differences, downstream components of Corrobora require a consistent data format. Both parsers transform their extracted data into standardized internal representations — implemented as standardized Python objects — rather than exposing provider- or hive-specific structures throughout the framework. This decision simplifies later development, makes additional artifact parsers easier to implement, and allows the future correlation engine to analyze Registry data alongside Event Logs and other Windows artifacts using a common internal format.
- Modular Architecture. Corrobora is being built one parser at a time. Rather than embedding artifact-specific parsing logic directly into the framework, each parser exists as an independent module. This modular architecture offers several advantages, including easier maintenance, isolated testing, improved code readability, reusable components, and simpler future expansion. As additional artifact parsers are developed, they follow the same architectural pattern.
Steps to Solve the Problem
Building the EVTX Parser
The EVTX parser processes an Event Log using a series of sequential stages:
EVTX File → File Validation → Record Extraction → Metadata Processing → Normalization → Structured Event Objects → Future Correlation Engine
Figure 2: EVTX Parser Workflow diagram
Each stage has a single responsibility, improving reliability and simplifying debugging when unexpected conditions occur.
The initial implementation focuses on extracting metadata commonly used during Windows forensic investigations. Current fields include Event ID, Timestamp, Provider Name, Computer Name, Event Channel, Event Level, Record Number, and Event Message (when available). Field selection and prioritization of commonly investigated Event IDs were informed in part by published quick-reference material such as the 13Cubed Windows Event Log Cheat Sheet (Davis, n.d.-a). These fields provide sufficient context for investigators while creating a standardized dataset that future Corrobora components can consume, rather than overwhelming users with every available XML element contained within an EVTX record.
Real-world forensic evidence is rarely perfect. Investigators may encounter corrupt Event Logs, incomplete records, unsupported providers, malformed XML, missing files, or permission issues. A parser intended for forensic investigations must remain resilient when encountering imperfect evidence. Instead of terminating execution, the parser records meaningful log messages and continues processing whenever appropriate, allowing investigators to identify problematic records while preserving successfully extracted evidence.
Building the Registry Parser
The Registry parser follows a similar structured workflow that transforms raw Registry data into normalized forensic records:
Offline Registry Hive → Input Validation → Hive Parsing → Key & Value Extraction → Metadata Normalization → Standardized Registry Objects → Cross-Artifact Correlation Engine
Figure 3: Registry Parser Workflow diagram
Each stage performs a specific task, making the parser easier to maintain and allowing individual components to be tested independently.
The current implementation focuses on extracting forensic metadata commonly used during Windows forensic examinations, including Registry hive name, Registry key path, Registry value names, Registry value data, Registry data types, Last Write timestamps (when available), system configuration information, and user-specific configuration data. Forensically significant Registry keys and values referenced during development were cross-checked against published quick-reference material such as the 13Cubed Windows Registry Cheat Sheet (Davis, n.d.-b). By normalizing this information into a consistent internal format, the parser prepares Registry evidence for comparison with Event Logs, Prefetch data, and future artifact sources.
Building the Registry parser presented a different set of challenges than developing the EVTX parser. Windows Event Logs are largely chronological records of events, whereas the Registry is organized as a hierarchical database consisting of keys, subkeys, and values. Traversing this hierarchy while preserving relationships between Registry objects required careful design. Another challenge involved handling the wide variety of Registry value types: strings, integers, binary data, and multi-string values each require different parsing logic, yet must produce standardized output consumable by the rest of the framework. As with the EVTX parser, the Registry parser was designed to be resilient when encountering malformed or incomplete data: rather than terminating execution after a parsing error, it records the issue and continues processing the remaining evidence whenever possible, maximizing the amount of information available for analysis.
Discussion
Most existing forensic tools already do an excellent job of parsing Windows Event Logs or Registry hives individually. That raises an obvious question: why build another set of parsers? The answer is that neither parser is an end goal. Their purpose is to produce structured, standardized data that can later be compared with evidence from other forensic artifacts.
For example, a Registry Run key may indicate that an application is configured to start automatically. A Prefetch file may show that the application was executed. Windows Event Logs may provide additional evidence that supports or contradicts those findings. Examining these artifacts together provides greater context than analyzing any one artifact in isolation. If Event Logs indicate an application executed successfully, investigators might expect corroborating evidence in Windows Prefetch files or Registry execution artifacts; if those supporting artifacts are absent or contradict the Event Log, that inconsistency may warrant further investigation.
Importantly, an inconsistency is not proof of anti-forensic activity. Legitimate explanations such as logging configuration, retention policies, or normal system behavior can also account for missing evidence. Corrobora is designed to surface these situations so investigators can evaluate them in context, not to replace human judgment. Rather than determining whether malicious activity occurred, Corrobora identifies inconsistencies that may warrant additional investigation; the final interpretation of those findings remains the responsibility of the analyst. This concept of cross-artifact consistency analysis is the core idea driving the framework.
Findings
Developing a parser is only the first step; equally important is validating that it accurately extracts forensic data. Both the EVTX parser and the Registry parser were tested against publicly accessible Windows forensic images, with output compared against established forensic tools to verify accuracy.
For the EVTX parser, testing verified Event IDs, timestamps, provider names, record numbers, and event counts against trusted forensic tooling. For the Registry parser, testing focused on verifying accurate key extraction, Registry value parsing, data type handling, Last Write timestamp extraction, error handling, and overall parser stability, with output likewise compared against established forensic tools. Testing with malformed and incomplete data, corrupted logs, and malformed XML for the EVTX parser, and malformed or incomplete hive data for the Registry parser has helped confirm that both parsers handle unexpected conditions gracefully without preventing analysis of the remaining evidence.
This validation process helps ensure that Corrobora’s interpretation of Event Log and Registry data is consistent with trusted forensic tools before that data is used in later stages of the framework, including the planned correlation engine.
Summary
Developing the EVTX and Registry parsers reinforced an important lesson that extends well beyond software development: digital forensic investigations are built upon evidence, not individual artifacts. A parser can successfully extract thousands of Event Log records or Registry values, but the true value of those records emerges only when they are interpreted alongside other independent sources of evidence.
Building these parsers also highlighted the importance of modular design, standardized data models, and robust error handling. One of the biggest lessons learned is that extracting data is only part of the challenge; presenting that information in a way that supports meaningful analysis while remaining transparent and explainable is equally important. These architectural decisions will simplify future development as additional artifact parsers and the correlation engine are added to Corrobora.
The EVTX and Registry parsers represent the first tangible milestones in the development of Corrobora, but more importantly, they establish the engineering patterns and forensic principles that will guide the rest of the project: an open-source framework that complements existing forensic tools by helping investigators compare evidence across multiple Windows artifacts in a transparent, explainable, and repeatable manner.
What Do You Think the Findings Mean?
Taken together, the EVTX and Registry parsers demonstrate that standardizing forensic data extraction across artifact types is achievable without sacrificing the depth of information investigators rely on. The consistency between Corrobora’s output and established forensic tools during testing suggests that the framework’s normalized data model is a viable foundation for cross-artifact comparison, rather than a simplification that discards forensically relevant detail.
More broadly, these early results reinforce the premise behind Corrobora: that meaningful forensic analysis often comes from understanding how multiple artifacts relate to one another rather than relying on a single source of evidence. They do not, on their own, demonstrate that cross-artifact correlation will reliably surface anti-forensic activity; that claim can only be evaluated once the correlation engine itself is built and tested. What they do show is that the underlying data both parsers produce is consistent, well-structured, and ready to support that next stage of development.
With the EVTX and Registry parsers complete, development now shifts toward Prefetch file parsing, followed by the design of the cross-artifact correlation engine, broader testing against Windows forensic images, and eventually anti-forensic activity detection through cross-artifact consistency analysis.
References
Davis, R. (n.d.-a). Windows event log cheat sheet (Version 1.3) [PDF]. 13Cubed. https://cdn.13cubed.com/downloads/windows_event_log_cheat_sheet.pdf
Davis, R. (n.d.-b). Windows registry cheat sheet (Version 2.0) [PDF]. 13Cubed. https://cdn.13cubed.com/downloads/windows_registry_cheat_sheet.pdf
Appendices
Tools and Versions Used
- Python 3.10
- python-evtx >= 0.7.4 (EVTX parsing)
- python-registry >= 1.3.1 (Registry Hive parsing)
- Visual Studio (development environment)
Systems / Versions Tested
- Windows 11 (author’s own forensic test image)
AI Disclosure
The header image accompanying the original Part 1 and Part 2 posts was generated using ChatGPT Instant 5.5. For this combined and rebranded version, a new header graphic was produced programmatically (Python/PIL) with AI assistance (Claude) as part of the publishing/editing workflow, replacing the prior ChatGPT-generated image. No other technical content, code, or analysis in this article was generated using AI; the underlying parser design, development, and findings reflect the author’s original capstone work.
List of Figures
- Figure 1: Corrobora project header image
- Figure 2: EVTX Parser Workflow diagram
- Figure 3: Registry Parser Workflow diagram
Resources
GitHub Repository:
https://github.com/Gear-I/Corrobora/tree/main
Connect with the author:
https://www.linkedin.com/in/dielle-d-350a0b186
Dielle De Noon is a cybersecurity professional with a growing focus on digital forensics and incident response (DFIR), forensic artifact analysis, and open-source security tooling. Dielle is particularly interested in understanding how digital artifacts can be examined, correlated, and validated to support evidence-based forensic analysis. Dielle’s background combines hands-on security administration, cybersecurity research, homelab experimentation, and continued learning in digital forensics. Areas of interest include Windows forensics, mobile device forensics, incident response, forensic artifact parsing, timeline analysis, and cross-artifact correlation.
