drop any binary · disk image · memory dump · scan for rfc 2822 email headers · extract complete emails · reconstruct eml files · runs locally
evidence
drop binary / image / dump
or click
drop memory dumps · disk images · any blob — carving stays local