Chainsaw is a command-line forensic analysis tool that rapidly searches and hunts through Windows forensic artifacts such as Event Logs and the MFT file.
The tool addresses the need for quick threat identification in Windows forensic artifacts when EDR agents were not present during a compromise. Chainsaw works by offering multiple detection approaches: it can hunt for threats using Sigma detection rules and custom Chainsaw detection rules, search artifacts through string matching and regex patterns, create execution timelines from Shimcache and Amcache data, and analyze the SRUM database. The tool also dumps raw content from forensic artifacts including the MFT, registry hives, and ESE databases. Built in Rust and wrapping the EVTX parser library, it emphasizes speed and lightweight output without unnecessary bloat.
Chainsaw suits incident response teams and threat hunters who need to perform rapid triage of Windows systems, particularly in environments where EDR coverage was absent during an incident. It is especially valuable for first-response scenarios where quick identification of threats is critical. The tool runs on macOS, Linux, and Windows, and outputs results in multiple formats including ASCII tables, CSV, and JSON. The README positions it as a solution for circumstances where forensic artifacts need analysis outside of EDR-captured telemetry.
The project maintains active development with regular updates and enhancements. The tool integrates established detection frameworks through Sigma rule support and the TAU Engine library for document tagging and detection logic matching. The codebase demonstrates attention to performance optimization through its Rust implementation and careful selection of dependencies. The project provides comprehensive documentation including a detailed wiki alongside the repository, supporting users in understanding both basic usage and advanced analysis capabilities.
