Frequently asked questions

Tracknosis gives you proactive forensic monitoring and continuous forensic observability for Windows Infrastructure. It reads each Windows volume and its registry directly, compares each scan with the ones before, and shows every file and registry change, rated High, Medium or Low with a plain-language reason. It keeps hash-verified evidence of what changed and when, and drafts incident reports from that evidence.

Those platforms are excellent at collecting logs and alerts, but they can only see events that were logged and forwarded. Tracknosis reads the file system and registry themselves, so it shows what actually changed on a machine, even where nothing was logged or the logs were cleared.

No. It works alongside them. Tracknosis sends its findings to Splunk through the HTTP Event Collector, so change evidence sits next to the logs and alerts your team already uses. Datadog and Elastic support is coming to the current release.

Tracknosis is a Windows application that runs with administrator rights and reads NTFS volumes. ReFS support is planned. Scan history is kept in a local database on the machine running Tracknosis. See Documentation for the requirements.

No. There is no kernel driver, no auditing to enable and no list of folders to configure. Tracknosis reads the volume directly, so it covers every file and registry key from the first scan.

Tracknosis works by scans. Each scan is compared with the history, so you see everything that changed in between, even changes that happened and were tidied up while nobody was watching. You choose how often to scan, for example daily, or straight away when you suspect an incident. The Network Activity and Performance views are live.

Yes, some. The first scan already flags files with faked timestamps and risky auto-start entries. To see exactly what changed and when, you need a scan from before the change, which is why it pays to take a baseline early.

A delta is every file and registry change between two scans. Looking at what changed before an incident turns a symptom into a diagnosis: a specific change, with a time and a location, that you can investigate, reverse and prove.

It doesn't rely on signatures. It looks for the changes attackers have to make, whatever tools they use: files with faked timestamps, cleared event logs, switched-off auditing, new auto-start entries pointing to unsigned or downloaded files, and new USB storage devices. New and unknown attacks show up as change.

Often, but not always. Tracknosis records where each file's data sits, so deleted files, such as attacker tools, can often be recovered. On a busy drive the space can be reused quickly. Recovered files are always written to a different volume, so the evidence is never overwritten.

AI drafts the incident report from the changes Tracknosis collected, with every finding traceable back to that evidence. The draft is for your team to review and complete; nothing is ever sent to a regulator automatically. Change detection and risk rating are rule-based, so results are repeatable and explainable.

NIS2 requires an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. DORA and UK GDPR set similar clocks, and in the US, CIRCIA is coming soon: 72 hours to report a cyber incident and 24 hours to report a ransom payment. Tracknosis gives you the evidence these reports need, and AI drafts built from it. Read more in our guide to the 24- and 72-hour clocks.

No. It drafts the report from the evidence; your team reviews it, adds context such as business impact, and decides what to send. Responsibility for the report stays with the organisation, as the regulations intend.

It can help you answer the questions insurers ask after an incident, such as what happened, when, and whether the attacker has gone, with evidence rather than estimates. Whether that affects your cover or premium is for your insurer to decide.

The slowest part of most investigations is working out what actually changed. Tracknosis answers that directly, so investigations are shorter, reporting deadlines are easier to meet, and you can show evidence rather than estimates. It also adds everyday IT value: asset and software inventory, and certificate expiry checks.

Our video is coming soon. In the meantime, contact us to arrange a live walkthrough, or see what Tracknosis shows you.

Yes. OEM licensing makes the Tracknosis forensic engines available to embed into partner products. See Partners for the routes to market.