Documentation

This page is an overview of how Tracknosis is used. Customers receive the full user guide and installation package with their licence. For the concepts behind the product, see the Technical Overview.

How Tracknosis works

Tracknosis runs on Windows and reads each NTFS volume directly: the master file table and the registry hives. It does not depend on Windows auditing, a kernel driver or a list of folders to watch, so every file and registry key on the volume is included.

• The first scan records the current state of the volume as a baseline. It already flags things that look wrong, such as files with faked timestamps and risky auto-start entries.
• Each rescan is compared with the scans before it, so you see exactly which files and registry keys were added, edited or deleted, and when.
• Every change is rated High, Medium or Low, with a plain-language reason.

Scan results are kept in a local database on the machine running Tracknosis, building a history you can go back to.

Requirements

• Windows, with .NET Framework 4.8.
• Administrator rights, because Tracknosis reads the volume directly.
• NTFS volumes. ReFS is not supported yet.
• Enough free disk space for the scan history, on a volume other than the one under investigation where possible.

Your first scan

1. Start Tracknosis as an administrator.
2. On the Dashboard, choose the volume to scan, for example C:. Choose C: — Registry instead for a faster scan of the registry only.
3. Select Scan and follow the progress bar. A first scan of a large system drive can take an hour or more; registry-only scans are much quicker.
4. When the scan finishes, the Dashboard shows the risk and change graphs for that volume.

Rescans and changes

Run a scan again at any time, for example daily, before and after maintenance, or as soon as you suspect an incident. Tracknosis compares it with the history and records only what changed. The sooner you have a baseline, the more you can prove later: changes can only be shown from the first scan onwards.

The Scan Report

The Scan Report lists every change between the scans you choose:

• Pick a range with From Scan Nr and To Scan Nr, or by date and time, then select Run Report.
• Filter by change type (Adds, Edits, Deletes) and by risk (High, Medium, Low).
• Master Records Only shows one row per changed file with the names of the fields that changed; Files Touched shows files that were only read or opened.
• Use Download Report to export the results.

Risk ratings and rules

Each change is rated using where the file is, what kind of file it is, whether it is digitally signed, whether it was downloaded from the internet, and whether its timestamps look tampered with. The reason is shown next to the rating.

To cut routine noise, right-click a row in the Scan Report to create a rule that hides similar changes. Rules never hide High-risk changes, executable files or protected locations.

Intrusion Detection

The Intrusion Detection view summarises suspicious activity since the last scan:

• new, changed or removed auto-start entries (Run keys, services, scheduled tasks and similar), each linked to the file it launches, with unsigned, downloaded or missing files flagged;
• cleared event logs, auditing switched off and logging stopped unexpectedly;
• new USB storage devices.

Deleted-file recovery

Right-click a deleted file in the Scan Report to try to recover it. Tracknosis uses the file's record and the location of its data noted at scan time. Recovery often works, but not always: on a busy drive the space can be reused quickly. Recovered files must be saved to a different volume, so the evidence is never overwritten.

Incident report drafts

From the Scan Report, NIS2/CIRCIA report drafts an incident report using AI, based only on the changes Tracknosis collected. Treat it as a first draft: review and complete it before sending it to a regulator.

Sending findings to Splunk

1. In Settings, enter your Splunk HTTP Event Collector (HEC) address and token. The token is stored encrypted on the machine.
2. Tick Log in the Scan Report to send the report's changes to Splunk, one event per record.
3. Intrusion Detection findings can also be sent to Splunk, and are sent automatically after each scan once Splunk is set up.

Everyday IT views

• Asset & Software: machine details, installed software, and an editable asset tag and owner.
• Certificates: certificates from the live Windows stores or from the scanned registry, with expiry, weak-crypto and self-signed findings.
• Network Activity and Performance: live views of listening ports and the processes that own them, and of CPU, memory and disk use.

Evidence handling

Tracknosis reads the volume without changing it. Each scan records the machine name, volume serial number, tool version, operator account and time in UTC, and results are hash-verified, so you can show where the evidence came from and that it has not been altered.

Can't find what you need? Contact support or browse the FAQ.