Skip to content
Disk Image Parser

Client-side disk forensics

Disk image forensics, in your browser.

Drop a disk image to read its MBR/GPT partition table and identify every filesystem — NTFS, FAT, exFAT, ext. Parsed locally in WebAssembly; the image never leaves your device.

From the blog

Read the blog
Carve deleted data from unallocated space
How deleted files survive in unallocated clusters, how to pull them out by signature, and the reasons (TRIM, fragmentation) the data often is not there.
dfirforensicsdata-recoverycarving
FTK Imager alternatives that run in your browser
What actually replaces FTK Imager for browsing and exporting from a disk image, where the browser wins, and where you still need the real thing.
ftk-imagerdfirforensicse01
Open a disk image online without uploading it
Most online disk image viewers upload your evidence to a server. Here is how to read one in the browser with nothing leaving the machine, and how to prove it.
dfirforensicsprivacye01