// artifact family
desktop app artifacts
6 browser-only forensics tools in this catalog group — browse by artifact family when you know the kind of evidence you are working with, not the investigation pattern.
tools in this family
ordered as in the forensics catalog. every tool runs locally — no upload, no account.
- slack desktop forensicsdrop slack app data files · parse conversations · channels · users · files · leveldb cache · sqlite databases · runs locally
- microsoft teams forensicsdrop teams app data files · parse messages · channels · users · calls · leveldb sqlite · runs locally
- thunderbird email forensicsdrop thunderbird profile files · mbox emails · address book · calendar · extension data · sqlite databases · runs locally
- vs code forensicsdrop vscode app data files · recently opened · workspace settings · extensions · git history · snippets · stored secrets · runs locally
- vs code deep forensic analyzerdrop vscode appdata directory contents · recently opened files · workspace history · extension list · git configuration · stored secrets · snippet history · reconstruct developer activity and project access · runs locally
- zoom application forensic analyzerdrop zoom sqlite databases · log files · configuration files · extract meeting history · chat logs · file transfer records · participant lists · recording artifacts · reconstruct zoom activity timeline · runs locally