drop a disk image or raw binary · scan unallocated space for browser session remnants · sqlite page fragments · leveldb entries · recover deleted browsing sessions · runs locally
unallocated-space carving yields incomplete fragments — gaps and false positives are expected. treat recovered urls as leads, not ground truth.
[disk image]
drop raw image (large files streamed)
or click
drop disk image or raw binary — scanned in 4mb chunks