The idea behind Elusive Data Firefly
James Eichbaum on the idea behind Elusive Data Firefly, why provenance matters after extraction, and why honesty is a forensic feature.
Free Digital Forensics Tools & Guides
Here you will find practical, field-tested tools and guides built to support digital forensic work. From iOS backup normalization to VarInt decoding, these utilities help you work faster and more precisely. We update the collection regularly.
digital forensics free tools
Field-tested, free tools
free tool | backup 2fs
Backup 2FS. A free tool to recover and normalize files from iOS backups.
Backup 2FS is a free Windows tool that helps you recover and normalize files from iOS backups.
free tool | varint calculator
VarInt Calculator. A free tool for calculating and decoding VarInts.
A free utility designed to help forensic analysts interpret and work with variable-length integers (VarInts), commonly found in app databases, protobufs, and messaging data.
digital forensics free guides & e-books
Free guides & e-books
free guide
Forensic Guide to GPT Partitioning
This free guide provides a practical walkthrough of GPT-partitioned disks, covering the Protective MBR, GPT Header, and Partition Entry Array. It’s designed to help forensic professionals understand disk structures, recover data, and validate evidence.
free guide
How to decrypt Locked Apple Notes on iOS 16.x. A step-by-step Workflow.
This free guide provides a practical walkthrough for forensic analysts dealing with encrypted Apple Notes in iOS 16.x. It focuses on identifying and decrypting locked notes stored in the NoteStore.sqlite database extracted from iOS backups.
news and articles
Latest news and articles
Dive into our curated articles, case studies, and guides designed to empower forensic professionals with the latest techniques and industry developments.
Elusive Data announces Firefly, a new forensic workspace for app data investigations
Elusive Data announces Firefly, a forensic workspace for modern app data evidence, launching August 31 with recovery, validation and reporting workflows.
What to Look for in a SQLite Forensic Tool
Many investigators start by looking for a SQLite forensic tool, but the real challenge is broader. This guide explains source-backed app-data work, provenance, validation and how Elusive Data Firefly extends the workflow beyond SQLite.
stay updated
Want to stay informed about new tools and updates?
Be the first to hear about new training opportunities, free tools, case-based blog posts, guides and practical insights. Our monthly newsletter is built to help you learn faster, solve cases smarter, and keep up in a field that never stands still.
Fill in your email to sign up.