whonix workstation artifact forensic extractor — free browser tool | fatcousin

drop whonix-workstation disk image · parse user activity + applications used

input

drop Whonix Workstation /home/user · bash history · recent files · browser · zip

or click

Select file

.bash_history · recently-used.xbel · tor-browser profile paths · cryptocurrency clients · paste site URLs in history

limits

heuristic parsing only · sqlite dbs inventoried not fully queried · no password cracking · no live network · not definitive proof

status

>ready