// artifact family
tor / dark web / privacy os
16 browser-only forensics tools in this catalog group — browse by artifact family when you know the kind of evidence you are working with, not the investigation pattern.
tools in this family
ordered as in the forensics catalog. every tool runs locally — no upload, no account.
- brave tor mode artifact forensic extractordrop brave browser tor-window cache · parse private session remnants
- dark web marketplace artifact forensic extractordrop browser history + screenshots · detect known marketplace URL patterns + screenshots
- freenet hyphanet artifact forensic extractordrop freenet/hyphanet node dir · parse data store + manifests
- gnu net artifact forensic extractordrop gnunet node data · parse peerstore + configs
- i2p bote mail artifact forensic extractordrop i2p-bote data dir · parse mailbox + identities
- i2p router artifact forensic extractordrop i2p router dir · parse netDb + routerInfo + tunnels
- monero wallet artifact forensic extractordrop monero-wallet-cli / gui wallet file · parse wallet metadata
- onion service discovery artifact forensic extractordrop tor hsdir cache · parse onion service descriptors served
- qubes os template artifact forensic extractordrop qubes os disk image · parse template + appvm artifacts
- tails os persistent volume forensic analyzerdrop tails persistent volume mount · parse retained user data + dotfiles
- tor browser artifact forensic extractordrop tor browser profile dir · parse state + places.sqlite + key3.db remnants
- tor browser bridge config forensic analyzerdrop tor browser torrc + state · parse pluggable transport + bridge usage
- tor relay log forensic analyzerdrop tor relay info / notices.log · parse circuit events + reachability
- vpn over tor traffic detectordrop pcap + tor consensus · detect vpn-over-tor patterns
- whonix gateway artifact forensic extractordrop whonix-gateway disk image · parse tor configuration + system state
- whonix workstation artifact forensic extractordrop whonix-workstation disk image · parse user activity + applications used