Cold Disk Quick Response
A forensic artifact parsing tool that quickly analyzes disk images and extracted artifacts from Windows, Linux, macOS, and Android devices.
What is Cold Disk Quick Response?
CDQR (Cold Disk Quick Response) is a forensic artifact parsing tool that rapidly analyzes disk images, mounted drives, and extracted artifacts from Windows, Linux, macOS, and Android devices. It uses the Plaso engine with curated parsers to generate structured CSV reports based on triaging best practices, helping investigators quickly identify key evidence during incident response.
Digital forensic analysts, incident responders, and cybersecurity professionals who need to quickly triage disk images or artifact collections during investigations.
CDQR simplifies forensic analysis by automating artifact parsing and report generation, reducing manual effort and providing a consistent starting point for investigations across multiple operating systems.
Overview
The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices
Use Cases
Best For
- Rapid triage of disk images during incident response
- Parsing extracted forensic artifacts from Windows systems
- Analyzing MFT and USNJRNL files for file system timeline reconstruction
- Generating standardized CSV reports for cross-case analysis
- Integrating forensic data into ElasticSearch for visualization in Kibana
- Processing forensic artifacts from Linux, macOS, or Android devices
Not Ideal For
- Incident responders requiring real-time memory forensics or live system analysis
- Investigations needing a graphical user interface for interactive data exploration
- Forensic labs that rely on comprehensive, deep-dive artifact analysis beyond triaging
- Teams without access to ElasticSearch or preferring other visualization platforms
Pros & Cons
Pros
Processes forensic images and artifacts from Windows, Linux, macOS, and Android, with tailored reports for each OS, as detailed in the README's report lists.
Leverages the Plaso engine with a curated set of parsers to accelerate analysis while maintaining compatibility with the broader forensics ecosystem.
Generates up to 18 CSV files grouped by artifact type, such as MFT and Registry, streamlining review by organizing data into logical categories.
Exports results to CSV, line-delimited JSON, or directly to ElasticSearch for integration with tools like Kibana and TimeSketch, enhancing visualization capabilities.
Cons
Requires a specific version of Plaso and Python 3.x, which complicates installation and updates, as noted in the dependencies section.
Produces fewer reports for Mac, Linux, and Android (8 or 7) compared to Windows (14 or 18), potentially missing forensic details for these platforms.
Operates solely via command-line with numerous arguments, making it less accessible for users unfamiliar with forensic tools or scripting environments.
Frequently Asked Questions
Related Projects
bulk_extractorThis is the development tree. Production downloads are at:
UACUAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
Forensic Artifact repositoryDigital Forensics artifact repository
CyLRCyLR - Live Response Collection Tool
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.