A lean, local-first open-source DFIR log workbench. Parses Apple Unified Logs, Android Intrusion Logs, EVTX, journald, and configurable text formats into a normalized timeline with tagging, notes, …

Free, open-source disk usage analyzer for macOS, Windows and Linux. See what fills your disk, servers (SSH) and cloud storage in an animated sunburst or treemap, and clean it up safely. A DaisyDisk…

This repo contains the publicly released versions of the open source scalpel3 file carving architecture.

Get your documents ready for gen AI

VoiceStudio is the open-source, fully-local ElevenLabs alternative — voice cloning, voice design, video dubbing, dictation, transcription & audiobook creation in 646 languages.

X-Ways Forensics Image I/O plugin that opens Apple DMG disk images: compressed (zlib, bzip2, LZFSE, LZMA, ADC), encrypted (AES, password prompt), segmented, sparse images and sparse bundles. C++, n…

ForenSync Imager — Python ve PyQt6 ile uzak disk/RAM edinimi ve adli bilişim portfolyo projesi

Various small helper scripts

DLEAPP — Desktop Logs Events And Protobuf Parser. A LEAPP for triaging desktop-application artifacts (Electron/Chromium).

Cyberduck is a libre FTP, SFTP, WebDAV, Amazon S3, Backblaze B2, Microsoft Azure & OneDrive and OpenStack Swift file transfer client for Mac and Windows.

Resources provided by the community that can serve to be useful for Law Enforcement worldwide

Easily run uv under Wine

Linux Memory Forensics Framework That Transforms Memory Dumps Into a Navigable Filesystem

Run a virtual iPhone on an Apple Silicon Mac.

Offline recovery + export tool for Telegram (macOS). Decrypts local db_sqlite and exports to HTML/Markdown/CSV.

Extract APFS FileVault hashes directly from a Mac in Recovery mode for cracking with hashcat

A list of public attacks on BitLocker

This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner.

Personal settings for X-Ways Forensics

BlindSite: High-Risk Investigations Platform & Forensic Browser

Forensic analysis of already-acquired WhatsApp Android databases - browse every chat exactly like the WhatsApp home screen, plus 30 forensic pages: media recovery, visual-hash search, contact + gro…

Script for extracting logical file system from .XRY container

Free, open-source SQLite viewer and forensic analyzer: search every table, browse millions of rows, decode BLOBs (bplist, protobuf) and timestamps, recover deleted records from the WAL and freed pa…

Privately extract images from encrypted iOS backups and search them with natural language using CLIP.

Mount forensic disk images, archives & memory dumps as a filesystem on Linux/macOS/Windows — ext4/NTFS/exFAT/HFS+/APFS/ISO, EWF/VMDK/AFF4, AD1, zip/7z/tar, LiME/AVML/crash dumps. FUSE + Dokan, ro/r…

Pure Rust EWF/E01 forensic disk image reader and writer — no libewf FFI