If you are doing DFIR research, writing custom parsers, or if you're a student trying to understand what’s actually happening under the hood, you know how hard it is to find solid documentation on modern Windows 11 binary structures. Microsoft has made subtle changes, and staring at a wall of raw hex without context is a nightmare when you're trying to learn or build.

To fix that, I just pushed a major update to Eye Describe an educational hub specifically designed for researchers and students. I’ve fully mapped out the exact binary anatomy of 6 core Windows 11 artifacts, down to the individual byte.

• Byte-by-byte hex mapping of the structures (Headers, flags, data blocks, etc.).
• Visual layouts so you can actually see how the offsets connect instead of guessing.

https://preview.redd.it/bwkndczoiy1h1.png?width=1547&format=png&auto=webp&s=841bd17315f6d0e5685226d3cb3db75cce92732b

You can check out the interactive anatomy guides here:https://crow-eye.com/eye-describe

I'd love to hear your feedback on the layouts. For the researchers and students out there doing deep Windows 11 forensics: what artifacts or specific offsets are you struggling to find documentation for right now?

When I started building Crow Eye, I did not want to just add another tool to the pile. I wanted to build a full spectrum forensic lifecycle platform. This release is a massive step toward making that level of transparency a reality.

The Vision: A Definitive Hub for Students and Researchers While it is true that not every tool out there is a black box, the DFIR industry still relies heavily on automated parsers that hide their underlying logic. To truly understand an artifact, you have to get down to its physical binary structure.

https://preview.redd.it/aq6x31z1jp0h1.png?width=1785&format=png&auto=webp&s=1ae9a2ac4f5ccedb1d0e3bb0240e3f25d5bcb9ad

Whether you are a student learning digital forensics for the first time, or a dedicated researcher reverse engineering new artifacts, Eye Describe Anatomy is built to be your ultimate learning hub. This is where we map the ground truth. Our goal is to document everything we currently know about these complex binary structures and, just as importantly, openly share what we do not know yet. This gives researchers a solid starting point to help fill in the blanks.

On top of that, Eye Describe will serve as the official documentary for exactly how the Crow Eye parsers work under the hood. No more guessing how the tools reach their conclusions. You get to see the exact structural logic driving the platform.

What is Live Right Now I built an interactive UI that maps out the exact binary structures of critical Windows artifacts step by step. You can explore the raw hex, translate values, and read forensic deep dives for:

Main Hub : https://crow-eye.com/eye-describe

The Roadmap: Empowering The Eye AI As you might know, our recent release introduced The Eye, our robust intelligence layer for comprehensive investigative support. Looking ahead, we plan to feed the entire Eye Describe knowledge base directly into The Eye AI assistant. Instead of just querying external data, the AI will have native access to this structural textbook. This will help investigators with their research and allow the AI to accurately analyze new and evolving versions of these artifacts.

The Roadmap: Empowering The Eye AI As you might know, our recent release introduced The Eye, our robust intelligence layer for comprehensive investigative support. Looking ahead, we plan to feed the entire Eye Describe knowledge base directly into The Eye AI assistant. Instead of just querying external data, the AI will have native access to this structural textbook. This will help investigators with their research and allow the AI to accurately analyze new and evolving versions of these artifacts.

Crow Eye v0.10.1 EXE is Now Available!

To support this growing ecosystem, I am excited to share that the compiled executable for Crow Eye v0.10.1 is officially out.

GitHub : https://github.com/Ghassan-elsman/Crow-Eye

I am proud to announce the release of Crow-Eye v0.10.0. This milestone marks the official launch of The Eye a robust intelligence layer designed to integrate your own AI agents directly into Crow-Eye, This isn't just a regular update; it’s a massive milestone for us . My goal from day one has been to build an ecosystem that doesn't just chase known signatures, but actually gives investigators the power to hunt zero-days

But as we celebrate this release and introduce our new AI layer, we need to talk about the elephant in the room.

The Problem with AI in Forensics

There’s a huge rush right now to slap AI onto cybersecurity tools, and honestly, a lot of it is dangerous. We are seeing "black box" solutions where investigators feed raw data into an LLM and just trust the answers it spits out.

In DFIR, an AI hallucination can ruin a case. An answer without mathematical, binary proof is worthless. If an AI agent cannot anchor its reasoning to exact offsets, hashes, and unmanipulated timestamps, we cannot trust it. To fix this, I realized we had to architect a system where the AI is bound by the exact same strict evidentiary rules as a human analyst.

The Starting Line: Automated Triage

Before the AI even wakes up, Crow-Eye does the heavy lifting. When you launch The Eye, the platform immediately runs a high-speed Automated Triage phase.

It queries the underlying SQLite databases to map out the ground truth: active users, execution histories, accessed files, USB devices, and Auto Run configs. This builds a comprehensive Initial Report. This report isn't the final investigation it’s the baseline. It’s the verified starting line before we let the AI touch the data.

The Brain of "The Eye"

I believe you should have total control over your data and your analytical "brain." That’s why The Eye is completely modular. You can plug in whatever intelligence fits your environment:

• Cloud AI Models: Hook up your public API keys for high-performance reasoning.
• Offline Servers & Local Inference: For air-gapped labs where privacy is non-negotiable.
  • Dev Note: A lot of my testing and development for The Eye was actually done using LM Studio and Google’s open-weights models (like the Gemma family). If you're a solo investigator, running Gemma locally on your own machine is incredibly powerful. Just a tip: push your context window as high as possible to handle the dense forensic payloads!
• CLI Agents: If you are a developer or researcher, you can hook up your own custom-built local agents, or seamlessly pipe in tools like Claude Code and the Gemini CLI.

https://preview.redd.it/zdg32192ic0h1.png?width=2023&format=png&auto=webp&s=a1458500b3765ccb1a7fb4018a9dcd2203bd7a1a

Keeping the AI Honest: The Ghassan Elsman Protocol (GEP)

Triage gives us the data, but the Ghassan Elsman Protocol (GEP) ensures the AI doesn't mess it up. The GEP is a strict set of rules hardcoded into the workflow to maintain a perfect chain of custody:

1. Case Awareness: The Initial Report is injected directly into the prompt to ground the AI in reality.
2. Pre-Flight Ping: Validates backend connectivity to stop silent failures.
3. Evidence Anchoring: Automatically tags and preserves raw hashes, IPs, and timestamps in the chat history.
4. Chain of Custody: Every truncation or data preservation event is meticulously logged.
5. Non-Repudiation: Messages are assigned deterministic, hash-linked IDs so records can't be altered.
6. Context Pinning: Critical evidence is locked and excluded from automated AI summarization.
7. Tool Traceability: Every tool the AI uses (like querying LOLBAS) is logged with exact execution counts.
8. Machine-Readable Synthesis: You get a clean JSON audit trail at the end to prove compliance.

What's Next: Bridging Analysis and Anatomy

While The Eye handles the high-speed analysis, our educational hub, Eye Describe, In upcoming updates, we are going to start building a bridge between these two tools. The goal is to gradually integrate visual references alongside the AI's findings. We want to reach a point where the AI doesn't just give you an answer, but helps point you toward the structural anatomy of the artifact it analyzed. It’s an iterative, ongoing project, but we believe it is an important step toward total forensic transparency.

This is the very first release of The Eye. You might hit a few bumps connecting to certain local backends or managing specific CLI tools, but we are actively squashing bugs and refining the experience over the next few weeks. Please submit any issues you find!

The latest source code and release are available right now on our GitHub. For those waiting for the compiled .exe version, it will be dropping very soon on our official website.

GitHub : https://github.com/Ghassan-elsman/Crow-Eye

good hunting