Commercial suites
Powerful analysis, but licence costs put them out of reach for independent examiners, schools and small teams.
Windows · Version 1.8.0 · Free
Commercial-grade forensic analysis,
free, in a single program
Until now, digital forensics meant buying an expensive commercial suite, or juggling several free tools and reconciling their results by hand. ForenSuite is a free, integrated digital forensics tool that brings the core features of FTK Imager, EnCase, Autopsy, REGA, NTFS Log Tracker and many other forensic tools into one program.
- No external commercial engine
- Evidence is always read-only
- English · Korean interface
- Pure Python + PySide6 (Qt)
Buy a suite, or stitch tools together
Until now, those were the two choices.
Several free tools
Imaging, file system analysis, registry and NTFS journal analysis each live in a different tool, and the examiner has to line the results up by hand.
ForenSuite
Acquisition, analysis, registry, NTFS logs, timeline and reporting all happen inside one case. Results land in one database and link to each other. Free.
250,000 files in about a minute
File lists are streamed straight into the case database instead of being held in memory, so memory use stays flat as the file count grows. If analysis stops, it resumes with only the remaining files.
61 sext4 3 GB, 250,511 files · peak memory 332 MB (the previous version did not finish within 40 minutes)
~40×Event log parsing speed of the built-in EVTX parser (vs. python-evtx)
Measured on the same PC with 2 cores.
Advanced analysis that holds its own against commercial tools
It is more than a collection of features. Records from many sources are checked against each other and summarised into near-conclusions, and deleted or damaged traces are brought back.
Acquisition · imaging
FTK Imager style
- Physical disks and volumes → E01, RAW (split) or VHD images
- MD5 / SHA1 / SHA256 verification during and after acquisition, with an acquisition report
- Read-only mounting, memory dumps (WinPmem built in), live system collection
File system analysis
Autopsy style
- NTFS, FAT, exFAT, ext2/3/4, ISO9660 on MBR or GPT
- Deleted and orphan files, ADS, unallocated space, file carving
- File type identification, extension mismatches, hash sets (NSRL)
Integrated analysis
Artifacts checked against each other
- Program execution merged from Prefetch, Amcache, ShimCache, BAM and more
- USB devices with their connection history and the files opened from them
- Anti-forensics traces: cleared logs, time changes, wiping tools
NTFS log analysis
NTFS Log Tracker style
- Correlation of $MFT, $LogFile and $UsnJrnl
- Rename and move tracking, deleted files and their recoverability
- Anomalies such as timestamp manipulation ($SI < $FN) and journal deletion
Registry · Windows artifacts
REGA style
- Hive analysis with transaction logs applied, deleted key and value recovery
- USB, Bluetooth, user activity, persistence and security settings
- Event logs grouped by meaning: logons, RDP, USB, PowerShell and more
Search · indexing
EnCase Index equivalent
- Full-text index of DOCX, HWP, PDF, EML and other documents
- Pattern search for ID numbers, card numbers, e-mail; regular expressions
- YARA rule scanning with a built-in YARA engine
Automatic file system repair
Read damaged volumes
- Boot sectors, FAT, $MFT, superblocks and GPT recovered from their backups
- Deleted partitions found and shown as "recovered partition"
- The original is never changed — repairs are a read-only overlay
Reports · scripting
EnScript equivalent
- HTML report, CSV bundle, KML (GPS map), TSK body file
- Activity (audit) log of how the evidence was handled
- Python scripts to query and process case data (6 examples)
Supported formats
Formats are detected from file content (signatures), not from the extension.
- Disk images
- E01 · Ex01 · SMART (s01) · AFF · AFF4 · RAW · split RAW · VHD · VHDX · VMDK · VDI · QCOW2 · DMG · Parallels · physical devices
- File systems
- NTFS · FAT12/16/32 · exFAT · ext2/3/4 · ISO9660
- Partitions
- MBR (incl. extended) · GPT
- Document text
- DOCX · XLSX · PPTX · HWPX · HWP 5.0 · ODF · PDF · RTF · HTML · EML · MSG
- Browsers
- Chrome · Edge · Whale · Firefox
Download
ForenSuite 1.8.0
Extract the ZIP and run run_windows.bat. If Python 3.10 or later is missing, the script helps you install it.
- File
- ForenSuite-1.8.0.zip (911,015 bytes)
- OS
- Windows
- SHA-256
- f43c31bea00fcb8771ea5162b1f8ee7e88a262b2ca9520a7a4e33d6a7d26f0ea
ForenSuite is intended for education and lawful digital forensic investigation. Use it only on systems and data you are authorised to examine. Automated results, especially suspicious items, must be reviewed by an examiner in context.