Examination tools
Forensic tools that run in your browser
Small, single-purpose tools for the questions that come up in every examination: what is this file, has it changed, what does this value mean and when did it happen. Each tool documents its method and cites the specification it follows.
Integrity and file identification 3
Establish what a file is and that it has not changed.
Hash calculator
Compute MD5, SHA-1, SHA-256 and SHA-512 for a local file, compare against a reference value and save a hash record.
File signature identifier
Identify a file from its leading bytes across 67 signatures, including SQLite, EVTX, registry hives, Prefetch, LNK and E01, and flag extension mismatches.
Hex viewer and data inspector
Browse any local file in hex, search for bytes or text, and decode the selected offset as integers, floats, FILETIME, Unix, FAT, Apple time and GUID.
Media and mobile identifiers 2
Read embedded photo metadata and validate device identifiers.
Exif and GPS reader
Read camera, time and GPS tags from a JPEG or TIFF locally, convert OffsetTime-qualified dates to UTC and see coordinates in decimal degrees.
IMEI structure check
Split an IMEI or IMEISV into TAC, serial number and check digit, and verify the Luhn check digit defined in 3GPP TS 23.003.
Encodings and time 3
Decode values found in databases, logs and the registry, and put them on one UTC timeline.
Encoding decoder
Decode Base64, Base64url, hex, binary, URL encoding, UTF-16LE and ROT13 side by side, and encode text for search terms.
Timestamp decoder
Paste an unknown number and see it decoded as Unix (s, ms, µs, ns), FILETIME, WebKit, Apple absolute, HFS+, GPS and FAT time, with plausibility flags.
Local time to UTC
Convert a wall-clock time in any IANA zone to UTC using historical daylight-saving rules, and flag times that are skipped or repeated.
Workbenches 5
Larger, multi-step environments for a complete piece of analysis.
SQLite & WAL Binary Inspector
Read a SQLite database and its WAL page by page: header, frames, checksums, commits and byte-level differences.
Communication Records Workbench
Load communication-record CSV files, normalise them to UTC, hash them and correlate number pairs with a source trail.
Timestamp Comparison
Compare NTFS, FAT32 and Unix time bases side by side: epoch, resolution and local-time behaviour.
Digital Time & File Lab
Convert Unix time and hash a file in one guided exercise.
Forensic Training Report
Write a structured technical report and download it as Word, PDF, TXT or JSON.
Practice cases 5
Fictional scenarios with prepared data, where the tools above are used to reach a documented conclusion.
SQLite Type Trap
Five decisions about SQLite storage classes and date functions.
Offset Paradox
Four UTC offsets, one true order of events.
Provenance Trail
Put four source and report records in the right order and justify the chain.
Missing USB
Order four records about a missing USB stick using their time offsets.
Night Shift
Rebuild the chronology of a night-shift incident and compare it with the reference solution.