Guide

From installation to the report for your first case, step by step.

1. Install and run

1. Download ForenSuite-1.8.0.zip with the button above.
2. Extract it: right-click → "Extract All".
3. In the extracted ForensicSuite folder, double-click one of the files below.

• If Python 3.10 or later is missing, the script tells you and, where possible, offers to install it (Y).
• The first run takes a few minutes to install packages. Later starts are immediate.

2. Administrator rights

The program runs with normal rights so that evidence files can be dragged in from Explorer.

Press [Restart as administrator] on the Home screen only when you need one of the following. The open case is reopened.

• Physical disk acquisition
• Memory dump
• Extracting locked system files
• Mounting an image

3. Display language

• Settings → Language switches between English and Korean. The change applies after a restart.
• On first start the program follows the Windows display language (Korean Windows → Korean, otherwise English).
• On the command line use --lang en / --lang ko, or the FORENSUITE_LANG environment variable.
• Only the program's own text is translated. Evidence data is never changed: file names, paths, registry values and mail are shown exactly as found.

4. Your first case

Follow the step guide on the Home screen: add evidence → analyse → review → bookmark → report.

1. Create a case — use [Case ▾] in the top bar or Ctrl+N. Open an existing case with Ctrl+O.
2. Add evidence — press [Add evidence] or drop an evidence file (E01, RAW, VHD …) onto the window. Evidence opens read-only; damaged volumes are automatically repaired from their backup structures as they are read.
3. Run analysis — choose a level (quick / standard / full). Integrated analysis is on by default. You can add keywords or regular expressions. Key files such as registry hives, event logs and browser databases are processed first, so results appear early.
4. Review — in [Analysis results], check categories such as suspicious items, program execution and external devices. In [Timeline], narrow the period and use "±5 minutes" to see what happened around an event.
5. Bookmark — press Ctrl+B on important files or records to add a tag (important, evidence, suspicious, needs review) and a note.
6. Report — in [Report], choose the sections and export an HTML report, CSV bundle, KML (GPS map) or TSK body file. Bookmarks and case notes are included.

If analysis stops because the program closed or an error occurred, saved results are kept. Press [Run analysis] again to continue with only the remaining files.

5. Screens

6. File actions · shortcuts

Select a file in a list, the gallery or search results: buttons appear above the preview, and right-click opens the full menu.

• Export — several files keep their folder structure, a hash list (CSV) and original times.
• Open — opens a read-only copy from a temporary folder with the default program. Executables and scripts are blocked to protect the analysis PC.
• Hash — MD5, SHA1, SHA256; find files with the same hash; VirusTotal hash lookup (the file is never uploaded).
• Browse inside archives and documents — ZIP, TAR, GZ, images inside DOCX/HWPX and thumbnail caches, browsed like folders.
• Hex editor — never writes to the original; saves only with "Save as", comparing original and edited SHA256 in the activity log.
• Add to hash set — make a bad / notable / good hash set from the selection for use in other cases.

7. Creating a disk image

1. Press [Restart as administrator] on the Home screen.
2. In Acquisition · Tools → Create disk image, choose the source (physical disk, volume or image).
3. Choose the format (E01 · split RAW · VHD) and destination, then start.
4. The image is verified with MD5 / SHA1 / SHA256 during and after acquisition, and an acquisition report is saved with it.

On the same screen you can re-check an image with integrity verification, image information, format conversion and read-only mounting.

8. Command line (CLI)

The same features work without the interface. If you have not built the program, use python -m forensuite instead of ForenSuite.exe.

ForenSuite.exe info     <image>
ForenSuite.exe acquire  <source> <dest> -f e01 --examiner "Jane Doe"
ForenSuite.exe verify   <image>
ForenSuite.exe ingest   <image> -o case.db --keywords secret mimikatz --regex "\d{3}-\d{3}-\d{4}"
ForenSuite.exe ntfslog  <image> -o ntfs_out
ForenSuite.exe carve    <image> -o carved
ForenSuite.exe report   case.db -o report.html --all

Continue an interrupted analysis with --resume; add --lang en for English output.

9. Moving to another PC

Build with build_windows.bat, then copy the whole dist\ForenSuite folder. The exe alone does not run (it needs the _internal folder next to it). The other PC does not need Python.

10. Cautions

• Evidence is always opened read-only. Preview "Open" also uses a temporary copy.
• Automated results, especially anomalies and suspicious items, must be reviewed by an examiner in context.
• Use the program only on systems and data you are authorised to examine.
• Scripts run with the same rights as the program. Run only scripts you trust.
• The cross-case correlation database stores file hashes, USB serial numbers, e-mail addresses and similar data. Place it according to your case security policy, or turn it off in Settings.