"Wow. I have to tell ya, I am very impressed. There are many spiffy enhancements, esp for the incident responder who has a bit of a clue. Great output, much improved config file, lots of command line options. Wow."
-- Don Murdoch (Author of SANS First Responder - Windows Course)

The Windows Forensic Toolchest™ (WFT) is designed to provide a structured and repeatable automated Live Forensic Response, Incident Response, or Audit on a Windows system while collecting security-relevant information from the system. WFT is essentially a forensically enhanced batch processing shell capable of running other security tools and producing HTML based reports in a forensically sound manner.

A knowledgeable security professional can use WFT to help look for signs of an incident, intrusion, or to confirm computer misuse or configuration. WFT produces output that is useful to the admin user, but is also appropriate for use in court proceedings. It provides extensive logging of all its actions along with computing the MD5/SHA1 checksums along the way to ensure that its output is verifiable. The primary benefit of using WFT to perform incident responses or audit is that it provides a simplified way of scripting such activities using a sound methodology for data collection.

I welcome any suggested features or changes or additional tool suggestions. Feedback from users of WFT would be greatly appreciated.