Codeword is an incident response tool for system administrators and computer forensic practitioners. It was built on the premise that critical forensic data is easy to get and that bulky forensic suites are unnecessary and do not serve the interest of the computer network defender. Codeword’s main purpose is to quickly expose this critical information in a meaningful way, so that an analyst can come to a reasonable conclusion about an enterprise-wide, active infection in minutes to hours.