Skip to content

Latest commit

 

History

History
67 lines (51 loc) · 2.27 KB

README.md

File metadata and controls

67 lines (51 loc) · 2.27 KB

ForenWare

Forensic Analysis Toolset for VMware Environments

Overview

ForenWare is a forensic data collection toolset tailored for VMware environments, supporting both vCenter and ESXi. It streamlines memory and disk acquisition, forensic file collection, and threat detection for digital investigations.

Key Features

  • Dual Environment Support: Seamless operation in vCenter and ESXi contexts.
  • Forensic Data Acquisition: Capture memory snapshots and disk images for in-depth forensic analysis.
  • Threat Detection: Integrates with THOR and Yara-x to detect malware and indicators of compromise (IOCs).

Setup

1. Install Dependencies

Run the dependencies.sh script to set up the required tools and libraries:

./dependencies.sh

2. Configure Inventory and Variables

Inventory File

Edit inventory.ini to define your target VMware hosts. Example structure:

[vcenter]
vcenter_host ansible_host=your-vcenter-ip ansible_user=your-username ansible_password=your-password

[esxi]
esxi_host ansible_host=your-esxi-ip ansible_user=your-username ansible_password=your-password

Variable Files

Modify the appropriate variable file based on your target environment:

  • vars-esxi.yaml for ESXi.
  • vars-vcenter.yaml for vCenter.

Usage

Run the Playbook

After setting up the inventory and variables, execute the Ansible playbook with the following command:

For ESXi:

ansible-playbook -i inventory.ini site.yaml -e "target_environment=esxi"

For vCenter:

ansible-playbook -i inventory.ini site.yaml -e "target_environment=vcenter"

Roles Overview

The toolset includes the following Ansible roles:

  • Mem_Acquisition: Captures VM memory snapshots, crucial for analyzing volatile data.
  • Disk_Acquisition: Creates VM disk snapshots for non-volatile data acquisition.
  • Forensic_File_Collection: Collects specified forensic files from the environment.
  • IOC_Sweep: Executes Yara-x or Thor scans for malware and IOC detection.

Contributing

Contributions are welcome! To contribute:

  1. Fork the repository.
  2. Make your changes.
  3. Submit a pull request for review.

License

This project is distributed under the MIT License. See the LICENSE file for details.