Active Directory forensic framework