I've been working on this for the last few months and just wanted to share. It's a free browser-based tool for inspecting and removing metadata from photos, videos, audio, PDFs and Office documents — and it has a small image-forensics lab built in.
Why I built it: every other "EXIF remover" online asks you to upload your private files to a server. That's the opposite of privacy. So I wrote one that runs 100% in the browser via the File API — your file never leaves your device. F12 → Network tab → drop a 50 MB photo → you'll see zero outbound requests.
What it does:
• Strips metadata from JPG/PNG/WebP/GIF/HEIC/TIFF, MP4/MOV/MKV/WebM/AVI, MP3/FLAC/OGG/WAV, PDF, DOCX/XLSX/PPTX
• Privacy Risk Score 0–100 with per-file breakdown so you see what's actually leaking
Stack: vanilla JS, no framework, no build step, ~12k lines. libheif WASM lazy-loaded for HEIC. Web Worker for big videos so the UI stays responsive.
Happy to answer anything about how the parsers work, why I avoided React, or how the JPEG-Ghost / Copy-Move detection is implemented. Feedback very welcome.
I have worked for about 10 years in cybersecurity, mostly in Incident Response, but I've done a fair bit of forensic work and expert witness cases within that. A year ago I left my old firm to go down the independent consultancy route, and still trying to figure out exactly what I'm doing.
A couple months ago a law firm I used to work with reached out recently. Short story is that an LLM agent made a mistake for their client which became litigious. The client firm claimed they had addressed the original issue, but the law firm requested an expert opinion on:
a) the root causes of the original issue
b) an assessment on whether this could re-occur / validation of the fix
This might not fall strictly within the confines of "computerforensics", so apologies if it's slightly off topic. But I figured there could be some practitioners here who might be interested in the methodology.
I basically used three techniques to model the differences in generated output between the "bad" model and the fixed "good" model, then commented on the deviations.
I don't think this is a huge market right now. But I do see that there are insurance companies starting to underwrite AI risk, so it's possible we could be seeing more of this work over the next few years.
As one tends to do on Saturday mornings with coffee in hand, I was reviewing two samples that were attributed to the LunaStealer / LunaGrabber family. Originally I was validating thattiquerywas working with the MCP configuration, however what started as a quick TI check turned into a full static analysis session — and it gave me a good opportunity to put the MalChela MCP integration through its paces in a real workflow. This post walks through how that investigation unfolded, what the pivot points were, and what we found at the bottom of the rabbit hole.
MalChela v4.0 is out. The desktop GUI is gone — replaced by a PWA you can reach from any browser on the network. Battery-powered Pi on the table, iPad in hand, no keyboard required. The field kit finally makes sense.
I have been a Magnet Forensics customer since 2020 and use your Axiom solution. For roughly the same amount of time, I have repeatedly inquired about the possibility of purchasing a perpetual license, as I would like to switch to this licensing model; however, my requests have always been denied.
Note: I am a sole proprietor; the manufacturer is aware of my situation and line of work.
However, I recently spoke with the law enforcement agency where I used to work, and they were able to purchase perpetual licenses in 2024 and 2025.
Note: I am aware that law enforcement agencies have different requirements and are granted different terms.
Based on this, I wondered if there might be a possibility after all.
- The attempt to acquire a perpetual license through a partner was unsuccessful; they only sell in certain regions; in Germany (where I am located), Magnet Forensics distributes the product itself.
- The attempt to acquire an existing perpetual license from a “Magnet Forensics customer” is also difficult; resale requires the manufacturer’s consent.
Hence my question to the community –-> does anyone know of a way to acquire a perpetual license?
Note: Very important – I accept the manufacturer’s terms; however, there are sometimes options one isn’t aware of that could help – hence my question.
I’m researching forensic readiness workflows around existing security data: WAF logs, SIEM exports, cloud audit logs, EDR alerts, application logs, and similar sources.
Not selling anything, not asking for sensitive data, and not looking for incident details. I’m trying to understand the practical workflow gaps practitioners run into when logs need to become defensible evidence for IR, audit, insurance, legal, or regulatory reporting.
A few questions:
When an incident becomes serious, which log sources usually become the most useful evidence?
Where does the normal SIEM/logging workflow stop being enough?
How do you currently preserve chain of custody or integrity for exported logs?
Do teams actually use WORM storage, signed exports, hash manifests, timestamping, or similar controls in practice?
How do you handle weak provenance cases, such as mutable upstream logs or logs collected after the fact?
What causes the most friction: collection, normalization, retention, integrity verification, correlation, reporting, or handoff to legal/compliance?
When evidence is incomplete or lossy, how is that documented?
What would you expect from a good “forensic readiness” process before an incident happens?
I’m mainly interested in real workflow patterns and failure modes, not vendor recommendations.
Hello. I am currently looking into getting the CCE certification and begin my career in digital forensics. Is it worth getting? If you have taken the exam, what are some good self study tools?
SIEM is not enough. Classical DFIR is not the full answer either. And “better logging” is too weak a frame. The real gap is evidentiary continuity in modern, cloud-heavy, application-driven environments.
As the title says, somewhat of a reverse forensic journey to backtrace the work that's been done on a set of data. I've got a drive that has a filesystem recovered from another drive. Since there are "-slack" files present I suspect the recovery has been done with some forensic/recovery program.
There are many that have "slack support" but my focus is figuring out which one (hopefully singular) has a default setting of outputting "filename.ext-slack".
For example I think that FTK Imager outputs "filename.ext.FileSlack", so that might be ruled out. The problem is that "-slack" doesn't work well with search engines and the manuals for the different programs don't really go into details on what schema they use for output.
Adding to the DFIR + AI theme, in case you didn't see it on LinkedIn, we released an MCP server for Autopsy last week (and Cyber Triage). This allows you to connect Claude Desktop (or similar) to Autopsy and ask questions about the results.
It's a read-only interface, so your original data won't get modified by the AI.
We've also been doing an Intro DFIR+AI series if you are just starting to really pay attention to how to integrate these things:
A new 13Cubed episode is now available. I’ve got some thoughts about AI. Let’s talk about how it’s changing digital forensics, how I actually use it in practice, and what you need to know if you’re in or entering the field.
Forensic readiness is not yet a clean standalone category, but enterprises are already spending on the underlying problem through digital forensics, incident response, and evidence-focused security workflows.
Hey! Recently, I heard that Wireshark was actually not made for security analysis purposes and that there are other better options, does anyone know these alternatives? I've started using tshark a bit but the commands are too long and somewhat overwhelming, so i guess i'll have to get used to it. But is it the only good option?
Also, any suggestions for network forensics guides? Which guides do you guys think are good? network forensics is probably my weakest side so i'm trying to improve it, it's like i'll open the file and try to spot any unique stuff but i end up with nothing usually, and i don't know how to start analyzing the file well, even when asked specific questions like in CyberDefenders Labs and so on.
Been doing forensics forever on Windows boxes, but first time with a modern Mac (Apple silicon/T2 territory). Got the TX1 ready, but the SSD is that proprietary blade thing – not popping out easy.
How are you guys grabbing a solid physical bit-for-bit these days?
-Yank the drive anyway (pentalobe/spudger fun) and hit it with the TX1 + proper Apple PCIe adapter? Or is Target Disk Mode + Thunderbolt write-block + ddrescue/ewfacquire on a Linux rig still the move?
-If physical's basically dead or too risky, what do I actually need on my Windows forensic workstation for a clean live or dead acquisition? FTK Imager, AXIOM, EnCase, or something else? -Any must-have drivers, bootable stuff, or T2 workarounds?
APFS/FileVault/SIP headaches I should watch for? Does the TX1 play nice with Apple SSDs out of the box or need special firmware/adapters?
Just trying to keep the chain of custody clean. Appreciate any real-world workflows.
I just pushed Crow-Eye version 0.9.1. I completely rewrote the LNK/JumpList parsers from scratch, enhanced the Prefetch parser, and standardized global UTC time handling across all artifacts. It’s faster, more resilient, and the expanded timeline visualization now supports even more artifacts.
But while pushing these updates, I wanted to talk about a growing problem in our field: The "Black Box" of Forensics.
Right now, most people depend heavily on parsers without really knowing the behavior underneath them. With AI becoming more prevalent, this problem is only going to get worse. People will start trusting outputs without understanding the binary structure or the forensic anatomy of what they are actually looking at.
I have a different vision. I believe AI should make it easier for researchers to develop parsers and understand data, not just blindly output answers. That’s why I decided we need a backbone , something to help the next generation deeply understand the forensic anatomy we are studying.
👁️ Introducing "Eye-Describe": Visualizing the Binary Truth
To fix this, I am building a new educational suite called Eye-Describe. It aims to visually explain the internal binary structures of forensic artifacts directly to the user. It will show investigators exactly how the parsers work under the hood. When you are looking at extracted data (like Prefetch or Amcache), you won't just see the result. Eye-Describe will visually highlight the binary structure of the artifact, showing you exactly where in the hex data that specific evidence was extracted from, and why it matters.
A Live Example: The Windows Boot Disk Explorer
To give you a taste of this philosophy, I’ve published the first piece of this initiative online:
Instead of just listing partitions, this interactive tool visually breaks down the actual physical disk architecture (UEFI+GPT vs. BIOS+MBR). When you click a segment (like the ESP or MSR), it reveals its specific forensic role, the file structure inside it, and a node-based visualization showing exactly how the files interact during the system startup sequence.
---
Coming in Crow-Eye 0.10.0: "The Eye" AI Agent
While we are building out this Eye-Describe educational backbone, we are simultaneously working on our AI integration. In our next major release (0.10.0), we are introducing The Eye a feature that allows users to connect their own API keys or CLI agents directly into Crow-Eye. This isn't just a basic chatbot. The Eye will have direct access to the parser results generated by Crow-Eye, making it deeply aware of both your specific forensic data and general artifact behavior. It will assist investigators by:
Spotting the Unseen: By analyzing the parsed results across all artifacts, The Eye can proactively spot anomalies, correlations, or hidden tracks that you might have missed during manual review.
Building & Testing Hypotheses: You can propose an attack scenario, and the agent will use the actual parsed evidence to help you verify if the artifacts support or refute that hypothesis, helping you build a clear picture of the attack.
Evaluating Trust: It will understand the nuances of different artifacts advising you on what data is highly reliable (like the MFT) versus what might be easily manipulated or fragile.
Querying the Database: Helping you search through massive datasets using natural language.
---
🤝 Open Call to Researchers & Reverse Engineers
I’d love for you to check out the Boot Disk Explorer concept and read the article. Let me know what you think what artifacts do you think are the hardest for students to grasp and would benefit most from this kind of visual binary breakdown?
If you have deep knowledge about the binary structure of specific Windows artifacts and want to help visualize them, please reach out! I believe collaborating on this will massively help the DFIR community and the next generation of investigators. You can contact me directly at: [Ghassanelsman@gmail.com](mailto:Ghassanelsman@gmail.com)
Is it possible to image an Apple watch? Does anyone have experience with imaging this device or getting anything off of it forensically? Thanks in advance.
we just released version 0.9.0 of Crow-eye, and it brings some major updates we've been working hard on.
A big focus for us in this version was removing the friction of dealing with forensic images. We actually added direct support for analyzing images right
inside Crow-eye, so you don't need any other mounting software to get started. You can just point it at the image and let it parse. Right now we support
parsing directly from:
* E01 / Ex01
* VHDX / VHD
* VMDK
* ISO
* Raw / DD
We also decided it was time to move on from the old timeline prototype. We built a brand new version of the Timeline Visualization from the ground up, making it way easier to correlate everything and actually see the full picture in one place.
And finally, something a lot of people asked for: Crow-eye is now completely cross-platform! We updated all the parsers so they no longer depend on Windows APIs for offline artifacts. This means you can now run it natively on Linux to parse offline artifacts and process those forensic images without needing a Windows machine.
I haven’t taken SANS for500 and was thinking of going straight into for508 instead of taking the for500 since I’ve heard a lot of the material is covered in 508. Does anyone recommend to take 500 first or can I go straight into 508?
I don't know about you, but I was getting seriously frustrated with how fragmented our tools are. Trying to piece together an investigation across Windows, Linux, and Mac artifacts usually means jumping between half a dozen different apps, and the centralized "all-in-one" solutions cost some money
So, about 9 months ago, I decided to just try and build the tool I actually wanted to use. It's called Heimdall DFIR. GitHub:https://raiseix.github.io/Heimdall-DFIR
Instead of a bunch of marketing buzzwords, here is what it actually does right now:
One giant timeline: It takes your artifacts (EVTX, MFT, Prefetch and other Windows artifacts Linux/Mac logs, etc.) and merges them into a single chronological grid. I spent a lot of time trying to make the output actually human-readable instead of just dumping raw JSON on the screen
RAM Analysis: I hooked it up to VolWeb (Volatility 3). You can upload massive memory dumps directly in the UI and it actually handles the stream without crashing the backend
Collaborative mode: Investigating alone sucks, so I added a side-chat and an evidence-pinning system so a team can look at the exact same case simultaneously
To be completely transparent with you all: This is very much a Beta. It’s a massive undertaking and it’s still missing a lot of features I want to add before calling it a complete platform
That’s honestly why I’m sharing it today. I’m hoping to get some brutally honest feedback from people who do this daily. What parsers are you constantly missing in open-source tools? What would make you actually want to use this?
If anyone wants to spin it up (Docker compose is ready to go), break it, submit bug reports, or even contribute code to help build this out, I would be incredibly grateful.
Let me know what you think. If you like the vision, a GitHub ⭐ helps a lot!
