_____ _ _ ___ __ | ___| | | | | \ \/ / | |_ | | | | | |\ / | _| | |__| |_| |/ \ |_| |_____\___//_/\_\
A high-performance digital forensic CLI tool built in C++17. Analyze disk images, recover deleted files, search raw bytes, carve artifacts, and reconstruct timelines — all from a single binary.
From raw dumps to enterprise virtual disks, open any image format natively without external libraries.
Navigate directories, recover deleted files, detect slack space, and reconstruct file trees on every major filesystem.
Every feature is designed for streaming I/O — constant memory usage regardless of image size.
Search across entire disks, partitions, or unallocated space with ASCII, hex, and binary wildcard patterns.
Reconstruct file activity with Modified, Accessed, Changed, and Born timestamps.
Recover files from unallocated and slack space using 50+ built-in file signatures.
Unix-style file browsing: ls, cd, tree, find, grep, cat, hex, strings — all inside the disk image.
Detect and recover deleted files from NTFS MFT records, EXT4 inodes, and more.
Parse system logs directly from disk images without mounting.
Calculate and verify file integrity with industry-standard algorithms.
Open disk images found inside parsed filesystems for recursive analysis with context stacking.
Save and restore entire analysis sessions, background jobs, and search results.
A complete interactive shell with tab-completion, command history, and pipe support.
| open | Open disk image, physical drive, or logical drive (C:, #N notation) |
| info | Display disk image metadata |
| list-devices | List available physical and logical drives |
| list-partitions | List detected partitions with type, size, and filesystem |
| select-partition | Select a partition for filesystem operations |
| dump | Create dd image from disk or partition |
| ls | List directory (-a -l -R -t -S -X -h -F -i -s --group-directories-first) |
| cd | Change directory (relative, absolute, ..) |
| pwd | Print working directory |
| tree | Directory tree view (-L depth, -d dirs, --deleted) |
| find | Search files (-name, -type, -size, -newercm, --deleted) |
| grep | Search file contents (-i -r -n -l -c -v -A -B -C) |
| list-files | List files with wildcard pattern matching |
| stat | Detailed file metadata (size, timestamps, record number) |
| cat | Display entire file content as text |
| more | Paginated file viewing |
| less | Advanced viewer with search and navigation |
| hex | Hexadecimal dump (--offset, --size, --hex/--utf-8/--unicode) |
| strings | Extract printable strings (-n length, -e encoding) |
| file | Detect file type using magic bytes and hashes |
| rawsearch | Pattern search: ASCII, hex, binary wildcards, background execution |
| rawsearch-batch | Batch search from pattern file (--combine, --separate) |
| carve | File carving from unallocated space (50+ signatures) |
| carve-list | List carved files with confidence scores |
| carve-export | Export carved files (--zip, --password) |
| export | Extract file to disk (--zip with optional password encryption) |
| undelete | Recover deleted files by path or record number |
| md5sum | Calculate MD5 hash |
| sha1sum | Calculate SHA-1 hash |
| sha256sum | Calculate SHA-256 hash |
| timeline | MACB timeline with date range, name, and event type filtering |
| timeline-export | Export to bodyfile or CSV format |
| timeline-stats | Activity statistics and hotspot analysis |
| last | Parse Linux wtmp/utmp login records |
| rdplog | Analyze Windows RDP EVTX logs |
| ntfs-logfile | Parse NTFS $LogFile transactions |
| tasks | List background jobs with progress |
| task-result | View detailed results (--limit, --head, --tail) |
| task-cancel | Cancel running background job |
| task-export | Export results to CSV or JSON |
| task-save | Save job results to file |
| task-load | Load saved job |
| task-save-all | Save all jobs to directory |
| task-clear | Clear completed jobs |
| task-list-saved | List saved jobs |
| task-clean-backups | Remove old backups (--older-than=N) |
| session-save | Save entire analysis session |
| session-load | Restore saved session |
| container-add | Create file group for targeted rawsearch |
| container-list | List containers or files within |
| container-remove | Remove files from container |
| container-delete | Delete container |
| open-image | Open nested disk image inside filesystem |
| back | Return to parent analysis context |
| timezone | Show/change display timezone |
| clear | Clear the terminal screen |
| help | Show available commands |
Streaming I/O throughout the entire pipeline. No file size limits, constant memory usage.