// artifact family
smart home / IoT forensics
15 browser-only forensics tools in this catalog group — browse by artifact family when you know the kind of evidence you are working with, not the investigation pattern.
tools in this family
ordered as in the forensics catalog. every tool runs locally — no upload, no account.
- alexa voice history forensic extractordrop alexa activity json csv or zip export · categorize voice commands · build timeline · infer usage presence windows · csv json export · runs locally
- google home artifact forensic analyzerdrop assistant my activity exports json html or zip · categorize cast speaker routines · device phrase inventory · timeline csv json · runs locally
- homekit accessory forensic analyzerdrop home backup zip or plist files · scenes triggers automation accessories · surface geofence lat lon · plist runs locally · csv json export
- ring camera artifact forensic extractordrop ring exported json csv or zip timelines · ding motion alarm ingest classification · utc hour occupancy heuristic · csv json export · runs locally
- nest camera forensic analyzerdrop nest google takeout json csv zip fragments · postal_code extraction · familiar visitor labels · activity zone inventory · csv json export · runs locally
- smart thermostat timeline analyzernest json · ecobee csv · generic mode csv · away/home cues · vacation windows · utc routine bands · corroborative occupancy · csv/json export · runs locally
- smart lock access forensic analyzeraugust/schlage csv · code slot NAMES · unlock→lock sessions · late-night anomalies · attributable keypad access · csv/json export · runs locally
- smart tv artifact forensic extractorsamsung lg json walks · viewing · apps · search · account linkage cues · heuristic timeline · csv/json export · runs locally
- roku chromecast usage forensic analyzerroku json · chromecast · youtube tv/play tagging · channel rollup density · heuristic filters · csv/json export · runs locally
- wifi smart plug forensic analyzerkasa · wemo · tuya heuristic json walkers · appliance alias surfacing · on/off sessions · presence dwell cues · csv/json export · runs locally
- home assistant forensic analyzerhome-assistant recorder sqlite + configuration.yaml · chain context_id across states/events · person/device_tracker presence timeline · automation + call_service timelines · exposes home gps from yaml · csv+json export · runs locally
- zigbee network forensic analyzerzigbee2mqtt logs · devices yaml · MQTT publish excerpts · reconstruct friendly ieee map · heuristic topic inventory · csv+json export · runs locally
- z wave forensic analyzerzwavejs logs · zwcfg xml · node inventory · value update timeline · friendly name substitution · csv+json export · runs locally
- iot firmware forensic extractorphase1 magic signature scan · phase2 streaming ascii strings urls credentials pem-ish · phase3 uimage + squash metadata surface · heuristic · no filesystem mount · csv+json export · runs locally
- bluetooth beacon environment reconstructorios bluetooth plist · android btsnoop hci · apple 0x004c manufacturer tlv · ibeacon uuid/major/minor · optional pcap link hint · venue uuid geolocation note · csv+json · runs locally