FS-Inspect

FS-Inspect: Forensic Toolkit

FS-Inspect is an open-source forensic toolkit for inspecting file systems, recovering deleted files, and analyzing disk images. It provides a graphical user interface and command-line tools for both Windows and Linux.

What is FS-Inspect?

FS-Inspect is an advanced open-source forensic analysis toolkit for inspecting and recovering data from storage media such as hard drives, USB devices, SD cards, etc. It can be used to recover deleted files and analyze disk images obtained from forensic duplications of storage media.

Some of the key features of FS-Inspect include:

• Support for a wide range of file systems including FAT12/16/32, NTFS, HFS+, Ext2/3/4, and XFS.
• Powerful data carving capability to recover files based on headers, footers, internal file structure as well as deleted files.
• File system analysis tools like timeline generation, file hashes, file sorting and filtering.
• Custom keyword searching capability across disk images and mounted drives.
• Integrated hex editor and metadata viewer.
• Mounts disk images as virtual drives for further analysis.
• Command line tools for automation and scripting.
• Runs on Windows and Linux platforms.

With its intuitive GUI and extensive command line tools, FS-Inspect simplifies many complex forensic tasks like data recovery, timeline analysis and file system inspection for investigating cyber crimes, analyzing malware impacts, internal investigations, analyzing rogue employee activities etc.

FS-Inspect Features

Official Links