OmniTriage/
├── collectors/
│   ├── __init__.py
│   ├── sysinfo.py         # OS build, InstallDate/Format date, Uptime (GetTickCount64), RAM
│   ├── execution.py       # PowerShell history, RunMRU, UserAssist (ROT13), BAM
│   ├── browser.py         # Chrome, Edge, Brave SQLite lock bypass & download records
│   ├── network.py         # Wi-Fi SSIDs, USBSTOR device history, active TCP sockets
│   ├── filesystem.py      # Executables/scripts in %TEMP%, SHA-256 hashing, Recent .lnk
│   └── persistence.py     # Registry Run/RunOnce keys & Startup folder audit
├── reporters/
│   ├── __init__.py
│   ├── json_reporter.py   # Normalized JSON serialization
│   └── html_reporter.py   # Standalone dark-mode HTML dashboard
├── omnitriage.py          # Main CLI orchestrator & banner
├── run_usb_triage.bat     # One-click USB rapid response launcher
├── LICENSE                # MIT License
└── README.md

git clone https://github.com/prox0959/OmniTriage.git
cd OmniTriage
python omnitriage.py

run_usb_triage.bat

python omnitriage.py --out D:\Evidence\Case_101

options:
  -h, --help            show this help message and exit
  --out OUT, -o OUT     Output directory for reports (default: triage_output)
  --quick, -q           Quick mode (skips deep file hashing)
  --json-only           Only produce JSON report
  --html-only           Only produce interactive HTML dashboard
  --no-browser          Skip browser history acquisition
  --no-fs               Skip staging directory filesystem scans
  --lang {en,tr}        Console output language (default: en)

   ____                  _ _____     _                 
  / __ \____ ___  ____  (_)__   \_ __(_) __ _  __ _  ___ 
 / / / / __ `__ \/ __ \/ /  / /\/ '__/ / _` |/ _` |/ _ \
/ /_/ / / / / / / / / / /  / /  | | / / (_| | (_| |  __/
\____/_/ /_/ /_/_/ /_/_/   \/   |_|/_/ \__,_|\__, |\___|
                                             |___/      
 [::] OmniTriage v1.0.0 | Pure Python DFIR Live Triage Engine
 [::] Author: Çınar (prox0959) | Zero External Dependencies

[*] Starting live forensic acquisition on target system...
[*] Destination: C:\Forensics\Case_01
[*] Acquiring OS telemetry, InstallDate, and Uptime...
[+] Host: DESKTOP-IR01 | User: analyst
[+] OS: Windows 10 Home (Build: 26200.9457)
[+] Windows Format/Install Date: 2026-07-03 16:31:44
[+] System Uptime: 0d 6h 52m (Boot: 2026-09-24 17:29:51)
[*] Collecting program execution evidence (PowerShell, RunMRU, UserAssist)...
[+] PowerShell history: 89 commands (0 flagged)
[+] RunMRU (Win+R history): 2 items
[+] UserAssist GUI applications: 100 items decoded
[*] Bypassing SQLite locks & harvesting browser history...
[+] Browser activity: 300 URLs, 19 downloads acquired
[*] Harvesting Wi-Fi profiles, USB connection history, and active sockets...
[+] Wi-Fi & Network Profiles: 2 profiles discovered
[+] Historical USB storage devices: 3 drives logged
[+] Active TCP sockets: 139 connections
[*] Scanning staging directories (%TEMP%, %APPDATA%) for suspicious executables...
[+] Executables in %TEMP%: 40 found
[+] Recent shortcut items: 40 items
[*] Auditing autostart persistence mechanisms (Run/RunOnce, Startup)...
[+] Registry Run/RunOnce keys: 20 entries
[+] Startup folder items: 4 files
[*] Compiling forensic reports...
[+] JSON Report written: C:\Forensics\Case_01\Triage_DESKTOP-IR01_20260925_002236.json (193.21 KB)
[+] HTML Dashboard written: C:\Forensics\Case_01\Triage_DESKTOP-IR01_20260925_002236.html (88.56 KB)

=================================================================
[+] Forensic acquisition completed in 0.24 seconds.
=================================================================