[Open Source] 🚀 TRACE: Toolkit for Retrieval and Analysis of Cyber Evidence 🚀

📂🔍 TRACE is a digital forensic analysis tool I developed for my final year project, designed with a user-friendly interface for investigating disk images. 📂🔍

 

👀 Preview

 

🔧 Features

• 🗂️ *Image Mounting: Mount forensic disk images. (Windows only)
• 🌳 Tree Viewer: Navigate disk image structures.
• 🔍 Detailed File Analysis: View file content in HEX, text, and application-specific formats.
• 📸 EXIF Data Extraction: Extract and display EXIF metadata from pictures.
• 🗂️ Registry Viewer: Examine Windows registry files.
• 🔪 *Basic File Carving -not fully integrated: Recover deleted files from disk images.
• 🦠 Virus Total API Integration: Scan files for malware using Virus Total.
• ✅ E01 Image Verification & Conversion: Verify integrity and convert E01 images to raw format.
• 💬 Message Decoding: Decode messages from base64, binary, and other encodings.
• And more!

 

💻🖥️ Cross-Platform Compatibility

Operating System	Screenshot
macOS Sonoma 🍏
Kali Linux 2024 🐧
Windows 10 🗔

 

💾 Supported Image Formats

Image Format	Extensions
EnCase® Image File (EVF / Expert Witness Format)	*.E01 *.Ex01
SMART/Expert Witness Image File	*.s01
Single Image Unix / Linux DD / Raw	*.dd, *.img, *.raw
ISO Image File	*.iso
AccessData Image File	*.ad1

 

🧱 Built With

• pytsk3 - Python bindings for the SleuthKit
• libewf-python - Library to access the Expert Witness Compression Format (EWF)
• PySide6 - Used for the GUI components.
• Arsenal Image Mounter - For mounting forensic disk images.

 

🔗 Explore TRACE on GitHub:

https://github.com/Gadzhovski/TRACE-Forensic-Toolkit/?abc

 

Socials 👨‍💻

---