dfir

Hindsight

Forensic file hasher — hashdeep for the modern era, BLAKE3 by default

Forensic disk analyzer — decode images & live devices, map partitions, flag anomalies

Read-only SQLite forensic CLI — carve deleted records, grade anomalies

Forensic timestamp decipherment - scored, cited, ambiguity-first

Open-source desktop workbench for digital forensic analysis