// artifact family
cross-platform correlation
20 browser-only forensics tools in this catalog group — browse by artifact family when you know the kind of evidence you are working with, not the investigation pattern.
tools in this family
ordered as in the forensics catalog. every tool runs locally — no upload, no account.
- mobile timeline reconstruction cross platformdrop ios + android artifacts · unified chronological timeline · timestamp normalization · gap detection · multi-source correlation clusters · csv re-import · runs locally
- mobile device pairing history forensic analyzerdrop ios lockdown plists · android adb authorized keys · usb logs · host identifiers · escrowbag alerts · certificate details · runs locally
- mobile to desktop artifact correlation tooldrop mobile + desktop csv exports · hash · url · search · identity correlation · confidence scoring · cross-device timeline · runs locally
- mobile cloud sync artifact forensic analyzerdrop icloud plists · accounts3.sqlite · android accounts.xml · per-app sync state · sync gaps · account inventory · runs locally
- icloud artifact forensic extractordrop icloud plists · bird daemon state · clouddocs sqlite · .icloud placeholders · cloudkit log excerpts · parse account identity sync metadata and drive inventory · surface cloud-only files · runs locally
- icloud keychain artifact forensic analyzerdrop ios keychain-backup plist keychain sync preferences or keychain-2.db · analyze icloud keychain sync state · classify items synced vs local-only · surface security circle peers · runs locally
- icloud drive artifact forensic extractordrop icloud drive databases clouddocs placeholders or mobile documents metadata · parse file metadata sharing and tombstones · surface cloud-only files · detect public links · runs locally
- google account artifact forensic extractordrop android accounts_ce.db gms databases or sync state files · parse google accounts service authorizations and grants · extract android_id gsf_id fcm token · runs locally
- google takeout forensic analyzerdrop google takeout zip or extracted folder · parse location search youtube chrome gmail photos calendar activity · reconstruct account timeline · surface behavioral patterns · runs locally
- mobile backup to cloud gap detectordrop ios backup plists manifest.db or android backup metadata · detect backup frequency gaps · classify elevated and significant gaps · surface disabled backup periods · runs locally
- mobile device handoff artifact forensic analyzerdrop handoff plist · knowledgeC.db · unified log · URL extraction · cross-device continuity timeline · runs locally
- cross-device clipboard artifact forensic extractordrop iOS clipboard plist · android logcat · samsung clipboard db · universal clipboard sync · snooping detection · runs locally
- mobile hotspot connection artifact forensic analyzerdrop powerlog · netusage · dhcp leases · logcat · bridge100 sessions · client device inventory · runs locally
- bluetooth pairing history forensic extractordrop iOS bluetooth plist · android bt_config.conf · logcat · CoD decode · pairing timeline · OUI lookup · runs locally
- wifi connection history forensic extractordrop iOS wifi plist · android WifiConfigStore · wpa_supplicant · SSID BSSID history · password artifacts · runs locally
- wifi probe request artifact forensic analyzerdrop WiFi probe request capture files, iOS diagnostic logs, or Android WiFi scan logs · parse probe request frames to extract SSIDs that devices were probing for · surface location history from probed network names · detect privacy-compromising probe request patterns · analyze device identifier exposure · runs locally
- nfc tap artifact forensic extractordrop iOS NFC tag interaction logs, Android NFC dispatch log, or NDEF dump files · parse NFC tap events · extract NDEF record contents, tag identifiers, and tap timestamps · surface NFC-triggered app launches and payment interactions · reconstruct NFC interaction history · runs locally
- mobile payment artifact forensic analyzerdrop iOS or Android payment-related database files, transaction logs, or wallet preference files · parse mobile payment transaction artifacts · surface payment amounts, merchant identifiers, and timestamps · detect payment method configurations · reconstruct payment activity timeline across Apple Pay, Google Pay, and other payment apps · runs locally
- apple pay artifact forensic extractordrop iOS Wallet/PassKit database files, Apple Pay keychain items, or powerlog data · parse Apple Pay enrollment state and transaction artifacts · surface Device Account Numbers (DANs), provisioning timestamps, and NFC payment events · identify enrolled cards and payment activity · runs locally
- google pay artifact forensic extractordrop Android Google Pay database files from the app data directory · parse enrolled payment methods, transaction records, and loyalty card artifacts · surface device account numbers, merchant interactions, and payment timestamps · identify transit pass and loyalty program usage · runs locally