// artifact family
filesystem & disk gaps
20 browser-only forensics tools in this catalog group — browse by artifact family when you know the kind of evidence you are working with, not the investigation pattern.
tools in this family
ordered as in the forensics catalog. every tool runs locally — no upload, no account.
- apfs snapshot deep forensic analyzerdrop apfs snapshot tree · parse object map + extent reference tree · runs locally
- btrfs send stream forensic extractordrop btrfs send stream · parse changeset · runs locally
- btrfs subvolume forensic analyzerdrop btrfs btrfs-progs export · parse subvolumes + snapshots + send streams · runs locally
- emmc chip off dump forensic parserdrop emmc chip-off raw dump · parse boot partition + rpmb + user area · runs locally
- f2fs deep forensic analyzerdrop f2fs partition image · parse node + segment + checkpoint structures · runs locally
- fat12 vintage media readerdrop floppy / vintage media image · parse fat12 directory entries · runs locally
- fat16 legacy media readerdrop legacy small media image · parse fat16 directory + cluster chain · runs locally
- hdd firmware area forensic analyzerdrop hdd firmware module dump · parse modules + p-list + g-list · runs locally
- jfs deep forensic analyzerdrop jfs partition image · parse allocation map + journal · runs locally
- nand raw dump forensic parserdrop nand chip-off dump (oob + page) · parse pages + spare bytes · runs locally
- refs windows resilient fs forensic analyzerdrop refs partition image · parse storage stream + integrity stream · runs locally
- reiserfs deep forensic analyzerdrop reiserfs partition image · parse tree + journal · runs locally
- sd card vendor unique data extractordrop sd card raw dump · parse cid/csd/vendor unique area · runs locally
- ssd trim residue estimatordrop ssd snapshot · estimate unrecoverable trimmed regions · runs locally
- ufs chip off dump forensic parserdrop ufs chip-off dump · parse boot lun + user lun + rpmb · runs locally
- wear leveling pattern forensic analyzerdrop ssd raw dump · detect wear-leveling artifacts that complicate recovery · runs locally
- wim windows imaging deep forensic analyzerdrop wim/esd image · parse contained image + xml metadata · runs locally
- xfs deep forensic analyzerdrop xfs partition image · parse allocation groups + journal · runs locally
- zfs dataset forensic analyzerdrop zfs zdb export · parse datasets + snapshots + holds + properties · runs locally
- zfs snapshot diff forensic analyzerdrop zfs snapshot diff (zfs diff output) · parse changes between snapshots · runs locally