A high-speed forensic timeline engine for Windows forensic artifact CSV output built for DFIR investigators. Quickly consolidate CSV output from processed triage evidence for Eric Zimmerman (EZ Tools) Kape, Axiom, Hayabusa, Chainsaw and Nirsoft into a unified timeline.

Digital forensic analysis tool that provides a user-friendly interface for investigating disk images.

Forensic Linux VM for Apple Silicon, ARM64 and x86-64 compatible platforms

Digital Forensics Essentials (DFE)

Utility for recovering ES File Explorer encrypted files (.eslock)

Forensic snapshot tool. Generates browsable offline HTML reports from drives, folders, and E01 images. Features file hashing and keyword search.Forensic snapshot tool. Generates browsable offline HTML reports from drives, folders, and E01 images. Features file hashing and keyword search.

Python tool to quickly extract embedded JPEG images from pcap files. Perfect for image extraction, data recovery, and digital forensics with reliable error handling..

A comprehensive Model Context Protocol (MCP) server for Android device forensic data acquisition using Android Debug Bridge (ADB).

PEInsight is a fast and efficient command-line tool for parsing Windows Portable Executable (PE) files, written in C.

Masstin: High-Speed DFIR Tool written in Rust and Graph Visualization in Neo4j for Comprehensive Lateral Movement Analysis

Android RAM Parser

SUDARSHAN is a simple, interactive digital forensics framework that helps investigators analyze data, recover evidence, and generate reports — all from one easy-to-use script.

Tools to decrypt files from the apk Vault - Hide Pics, App Lock

Browser-based Mac Model Finder — A forensic reference tool for identifying Apple computer device models, T2 and Apple Silicon systems, and acquisition workflows. Created by Junaid Abid for demonstration and educational purposes.

A MATLAB-based Digital Image Forensics Dashboard for detecting image tampering using ELA, Noise Analysis, JPEG Artifacts, and Copy-Move detection.

Cross-platform Forensic Imaging Tool

Artifact acquisition and the analysis of REGISTRY hives

A GUI based Hacking Toolkit with multipurpose usecases such as finding hash of text or file, Text to Hex, Hex to Text Conversion Encryption and much more

Actively removes unwanted files as they're created, plus reorganizes the kept files into a type-based folder structure.

Run FTK Imager directly from a portable USB or WinFE environment to perform forensic imaging without installing software on the target system.