e01

Open-source digital forensics (DFIR) toolkit with a desktop GUI: analyse E01, AFF4, raw/dd and VMDK disk images, recover deleted files by file carving, build timelines, search evidence and run YARA/Sigma rules. Windows, macOS, Linux.

This is a GUI (for Windows 64 bit) for a procedure to virtualize your EWF(E01), DD (raw), AFF disk image file without converting it, directly with VirtualBox, forensically proof.

A command-line tool for searching files, directories, and alternate data streams directly from NTFS image files.

A command-line tool for efficiently extracting files, directories, and alternate data streams directly from NTFS image files.

⤳ Moved to SecurityRonin/ewf-forensic — EWF/E01 reader, now the core/ member there. Crate 'ewf' still published.

Forensic snapshot tool. Generates browsable offline HTML reports from drives, folders, and E01 images. Features file hashing and keyword search.Forensic snapshot tool. Generates browsable offline HTML reports from drives, folders, and E01 images. Features file hashing and keyword search.

Forensic disk-image orchestrator — decodes E01/VMDK/VHDX/VHD/QCOW2/DMG containers, auto-detects MBR/GPT/APM, and routes ISO 9660 to filesystem analysis

吉利 ICON 2020款 / E01 车机 (Android 5.1) 的 CarPlay 接收端适配 · 固件普查阶段，topics 加 carplay diplay geely android-headunit e01

Free, open-source automation of Windows forensic examinations: load an E01/raw/VMDK/VHDX image, pick a case type (DLP, USB, malware, phishing, ClickFix, RMM, ransomware), get answered questions, every parsed artifact as CSV and a court-ready report. Validated against NIST CFReDS.

Recuperação forense de vídeos e fotos a partir de imagens E01/dd, com mapa físico do dispositivo animado. GPL-3.0.

Complete digital forensic investigation of the M57-Jean dataset with documented methodology, findings, and forensic report.

This is extention of H08-E01 game

FAEP is an automated tool to extract and parse forensic artifacts from .E01 images automatically, with a clean GUI and minimal manual effort.

Fubon Future API

Pure-Rust toolkit and CLI for forensic evidence images: read, verify, acquire, and convert E01, L01, S01, Ex01, Lx01, AFF4, and raw.

Experimental macOS Swift toolkit for E01/ZRun round BLE badges and a Codex allowance dashboard

ZFF review

Forensic imager in Rust with FTK Imager-compatible output — bit-for-bit E01/raw acquisition, targeted logical collection, read-back verification of image and source, resume.

End-to-end digital forensics lab — forensic image acquisition with FTK Imager (E01 format, MD5/SHA-1 verification) and deleted file recovery & artifact analysis with Autopsy (The Sleuth Kit). Recovered 70+ deleted files from unallocated NTFS sectors. Educational DFIR project aligned with NIST SP 800-86.

Read-only forensic VFS contracts composing evidence into one positioned-read byte edge — ArchiveOpen · ContainerOpen · VolumeSystemOpen · EncryptionOpen · FileSystemOpen — with recursive PathSpec locators. The contract crate every fleet reader implements.