An open-source Python forensic suite that opens E01, AFF4 and raw images read-only, carves deleted files, timelines user activity and generates court-ready reports for authorized investigators.
| Tool | Gadzhovski/TRACE-Forensic-Toolkit — open-source desktop DFIR toolkit for analyzing disk images without mounting or writing to them |
| Category | Digital forensics / incident response (DFIR) GUI toolkit |
| Primary Use | Case-based analysis of E01/AFF4/raw images, file carving, YARA/Sigma detection and timeline reconstruction in authorized investigations |
| Safe Use | Designed for authorized forensic examiners, incident responders and lab analysts working on evidence they are legally entitled to examine; purely read-only and defensive in nature |
| Telemetry Note | TRACE never touches the evidence: it reads images without mounting, verifies full hashes (MD5, SHA-1, SHA-256), keeps an append-only hash-chained audit trail, and hashes every export into a manifest — leaving defender-verifiable integrity artifacts rather than traces on targets |
TRACE-Forensic-Toolkit — the Toolkit for Retrieval and Analysis of Cyber Evidence — is a rare entry in the open-source DFIR space: a full desktop application rather than a loose bundle of CLI scripts. Written in Python with a PySide6 interface, currently at version 2.5.0 and MIT-licensed with 215 stars, it targets examiners who want to open disk images, triage them, search inside them and recover deleted files without ever mounting or writing to the evidence. It runs on Windows, macOS and Linux from Python 3.10+, installs entirely from pre-built packages with no compiler required, and the README shows an unusually disciplined engineering posture for a solo-developed project.
The core workflow is case-centric. An investigation holds any number of images alongside custody details, bookmarks, notes and tags, and produces PDF, HTML or Word reports. Two views — an Artifacts list and a Case Overview — inventory everything the case contains and, tellingly, which scans have not been run yet. That last detail matters operationally: in real casework the failure mode is not usually missing data but forgotten processing steps, and TRACE surfaces the gaps explicitly rather than letting the examiner assume completeness.
Integrity handling is where the README is most detailed, and it reads like someone who has had findings challenged. Every image is hashed in full (MD5, SHA-1, SHA-256) and a read that fails yields no hash at all — the tool refuses to fabricate a value for damaged media. The computed hashes are checked against the hash the image stores, its acquisition log and the case record, which is never replaced. For E01 containers, chunk checksums localize damaged sectors instead of just reporting a vague mismatch. Every check is retained, the audit trail is append-only and hash-chained, and exports are themselves hashed, read back and listed in a manifest. This is chain-of-custody thinking baked into the architecture rather than bolted on.
Evidence support is broad enough to cover most lab intake. Container formats include E01/Ex01, AFF4, raw/dd including split files, ISO, DMG, VMDK, VHD/VHDX, QCOW2 and Parallels images. Logical formats span AD1, L01, ZIP/TAR, plain folders (including KAPE and Velociraptor output), iOS and Android backups, and Cellebrite UFDR and GrayKey extractions. Attached live disks can be examined read-only without imaging first. The file-system matrix runs from the expected — NTFS, FAT, exFAT, ext2/3/4, HFS+, APFS, ReFS — through XFS, Btrfs, ZFS, F2FS and UDF, down to embedded flash formats like UBIFS, JFFS2, YAFFS, LittleFS and the QNX filesystem family. Encrypted volumes (BitLocker, FileVault 2, LUKS 1/2, VeraCrypt/TrueCrypt, encrypted APFS) can be unlocked with credentials, and volume managers — Core Storage, LVM, hardware and software RAID, Windows dynamic disks — plus virtualization disk formats are handled natively under the hood.
Triage covers the questions an examiner asks in the first hour. Files are typed by content rather than extension, entropy is computed, hidden data is flagged, and photo EXIF GPS coordinates are resolved offline into human-readable place names — the README gives the example "4 km NE of Reading, United Kingdom" — which is a thoughtful touch for report writing without leaking queries to online services. Documents yield their authors, Office files expose VBA macro source with auto-run and download/execute calls flagged, and executables get imphash and Rich-header hashes for pivoting against known samples. Duplicates and hash sets round out the bulk filtering.
User-activity reconstruction is the other pillar. TRACE parses program execution traces, opened files, USB device history, logons, the Recycle Bin, browser history, chats and phone backups from Windows, macOS (including Spotlight, Biome and the unified log), Linux and even ChromeOS, and merges them into a single timeline. The timeline collapses event bursts, supports lanes per source, and — importantly for testimony — flags clock changes, gaps and timestomping indicators, acknowledging that timestamps are evidence about the clock as much as the activity.
Detection capabilities make it useful for incident response, not just dead-box forensics. YARA rules run over files, Sigma rules run over event logs, keyword lists drive triage, and persistence/autorun locations are enumerated and graded by risk. Search is full-text across documents, mail and archives, with automatic extraction of emails, URLs, phone numbers, card numbers and IBANs — a mix of investigative search and compliance-relevant entity spotting. File carving handles 70 file types from unallocated space or slack, verifies completeness, and can rebuild fragmented ZIP and PDF files, which is a genuinely hard problem most open tools sidestep.
The viewer layer is deep enough to reduce tool-switching: images come with examiner tools (pixel inspection, error level analysis, JPEG quality, frame-by-frame and EXIF thumbnail checks), video has metadata, frame stepping and contact sheets, and there are viewers for PDF, Office/RTF (including password-protected files given their password), Outlook .msg, pcap (with hosts, DNS, HTTP and TLS server names), SQLite (cells stored as files openable as files), registry hives and a hex editor with a data inspector. HTML is rendered offline — another anti-exfiltration detail consistent with the rest of the design.
The external-module integration is the most architecturally interesting decision. TRACE can install and run the *LEAPP family — iLEAPP for iOS, aLEAPP for Android, RLEAPP for warrant returns, VLEAPP for vehicles, DLEAPP for computers — pulling each from its own releases after checking the published SHA-256. They run against copies TRACE extracts from evidence, never the original, and whatever they parse flows back into TRACE's own Activity, Conversations, Map, Timeline and Search views, with provenance: every record states which tool read it. That provenance-per-record approach is exactly how multi-tool pipelines should work.
Exports target the wider forensic ecosystem rather than a proprietary format: Timesketch, plaso and mactime timelines, DFXML, CASE/UCO and Project VICS for review tools like Griffeye, with each export documenting which scans it would still lack. Installation is a single script per platform: git clone the repository and run install_windows.ps1 or ./install.sh, which locates Python 3.10+, installs system libraries across apt, dnf, pacman and zypper, and verifies that the forensic engines, Qt and libmagic actually load before declaring success. Standalone .zip/.dmg builds are produced on every push via GitHub Actions.
Under the hood TRACE leans on proven libraries — The Sleuth Kit via pytsk3, libewf, the libyal collection, PyMuPDF, Pillow — which is the right call over reimplementing parsers. What stands out overall is the testing claim: every master change is installed from scratch and exercised on Windows, macOS (both architectures) and Linux against public test images from DFTT, DFRWS, NPS and NIST, with file carving scored against published answer keys. For an authorized examiner, analyst or student building lab competence on forensic test images, TRACE is one of the most complete free GUI options available, and the only caveats worth noting are its GUI-first workflow (limited scripting surface compared to plaso pipelines) and the need to validate version-specific behavior in your own environment before relying on it in casework.
Gadzhovski/TRACE-Forensic-Toolkit.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.