Forensics

Analyze photos for tampering with ELA, noise analysis, clone detection and EXIF metadata extraction. 100% in-browser - your image never leaves your device.

Analyze audio for edits with waveform and spectrogram views, clipping and noise-floor checks, recompression sensitivity, mains-hum (ENF) tracing and ID3/WAV metadata extraction. 100% in-browser - your audio never leaves your device.

Analyze pcap and pcapng network captures in your browser - packet list, TCP stream reassembly, HTTP and DNS dissection, TLS JA3 fingerprints, top talkers and cleartext credential exposure. 100% in-browser - your capture never leaves your device.

Analyze PDF and Office documents in your browser - reconstruct a PDF's incremental-save revision history, see what text changed between saves and what sits under a redaction box, or read an Office file's full VBA macro source, recover tracked changes and hidden content, and list every external link it would contact. Legacy .doc/.xls/.ppt and .rtf supported. 100% in-browser - your document never leaves your device.

Inspect any file's true type by magic bytes, carve embedded files at any offset, visualize byte-entropy to spot packed or encrypted regions, and compare two files byte-by-byte in a hex viewer. Drop a ZIP, TAR, GZIP, BZIP2, XZ, 7z or RAR archive and its structure is read too - every entry's real compression method and flags, zip-slip path traversal, compression bombs, and archives nested inside archives, without ever decompressing a suspected bomb. 100% in-browser.

Analyze raw .eml email files in your browser - reconstruct the Received header delivery chain, review SPF/DKIM/DMARC authentication results, inspect attachments for type mismatches and double extensions, and spot phishing-style link mismatches in the HTML body. 100% in-browser - your message never leaves your device.

Analyze Chrome and Firefox profile databases in your browser - rebuild browsing and download timelines, inventory cookies, spot evidence that history was cleared, and recover deleted records from freed pages. 100% in-browser, nothing is uploaded.

Analyze MP4, MOV, WebM and MKV files in your browser - walk the container structure, read creation timestamps and encoder tags, inspect any frame with error level analysis, and sweep keyframes for the compression break that marks a splice. 100% in-browser, nothing is uploaded.

Inspect Windows PE, Linux ELF and macOS Mach-O executables in your browser - headers, sections with per-section entropy, imports/exports, embedded resources and version info, TLS callbacks, and Authenticode signature presence. 100% in-browser.

Parse a Windows registry hive - SYSTEM, SOFTWARE, SAM, NTUSER.DAT, UsrClass.dat or Amcache.hve - entirely in your browser. Walk the real key tree, decode autoruns, USB history, UserAssist, ShellBags, installed software and services, recover deleted keys from free space, and build a timeline. Your file never leaves your device.

Parse Windows Event Log (.evtx) files and text logs - syslog, auth.log/secure, Apache/nginx access and error logs, IIS W3C - entirely in your browser. Decode Windows security events with logon-type and status-code context, merge every source onto one unified timeline, and detect brute-force logins, password spraying, log tampering and audit-log clearing. Your files never leave your device.