ewf

This is a GUI (for Windows 64 bit) for a procedure to virtualize your EWF(E01), DD (raw), AFF disk image file without converting it, directly with VirtualBox, forensically proof.

⤳ Moved to SecurityRonin/ewf-forensic — EWF/E01 reader, now the core/ member there. Crate 'ewf' still published.

Forensic disk-image orchestrator — decodes E01/VMDK/VHDX/VHD/QCOW2/DMG containers, auto-detects MBR/GPT/APM, and routes ISO 9660 to filesystem analysis

SwiftBeaver is a high-speed file and artefact carver written in Rust that recovers files (JPEG, PNG, PDF, ZIP, SQLite, MP4, and many more) and Windows artefacts from raw and E01 disk images. It emphasizes reproducibility, read-only evidence handling, and rich JSONL/CSV/Parquet metadata, with optional OpenCL/CUDA acceleration.

Pure-Rust toolkit and CLI for forensic evidence images: read, verify, acquire, and convert E01, L01, S01, Ex01, Lx01, AFF4, and raw.

Real-world guides for wrapping forensic disk image libraries into Swift Packages on macOS. Built on Apple Silicon, errors and all.

Forensic imager in Rust with FTK Imager-compatible output — bit-for-bit E01/raw acquisition, targeted logical collection, read-back verification of image and source, resume.

ZFF review

GTK GUI for ewfacquire

Windows batch wrapper around robocopy for copying digital evidence between local drives or network shares: always logged and SHA-256 verified, with sealed chain-of-custody records and a copy history that travel with the evidence and are checked on every copy or in place (/check). Built-in tools only.

Forensic Tool

Read-only forensic VFS contracts composing evidence into one positioned-read byte edge — ArchiveOpen · ContainerOpen · VolumeSystemOpen · EncryptionOpen · FileSystemOpen — with recursive PathSpec locators. The contract crate every fleet reader implements.

Forensic integrity analysis and repair for EWF (Expert Witness Format / E01) images

SUPERSEDED — merged into sltcnb/MemoryLane, which is now the Rust implementation and a strict superset of this repo.