Free Digital Forensics Tools & Guides
digital forensics free tools
Field-tested, free tools
free tool | backup 2fs
Backup 2FS. A free tool to recover and normalize files from iOS backups.
Backup 2FS is a free Windows tool that helps you recover and normalize files from iOS backups.
free tool | varint calculator
VarInt Calculator. A free tool for calculating and decoding VarInts.
A free utility designed to help forensic analysts interpret and work with variable-length integers (VarInts), commonly found in app databases, protobufs, and messaging data.
digital forensics free guides & e-books
Free guides & e-books
free guide
Forensic Guide to GPT Partitioning
This free guide provides a practical walkthrough of GPT-partitioned disks, covering the Protective MBR, GPT Header, and Partition Entry Array. It’s designed to help forensic professionals understand disk structures, recover data, and validate evidence.
free guide
How to decrypt Locked Apple Notes on iOS 16.x. A step-by-step Workflow.
This free guide provides a practical walkthrough for forensic analysts dealing with encrypted Apple Notes in iOS 16.x. It focuses on identifying and decrypting locked notes stored in the NoteStore.sqlite database extracted from iOS backups.
news and articles
Latest news and articles
Dive into our curated articles, case studies, and guides designed to empower forensic professionals with the latest techniques and industry developments.
SQLite Forensics Explained
SQLite forensics explained in simple terms. Learn how SQLite databases store data, where evidence is hidden, and why it matters in digital investigations.
Protocol Buffers for Forensic Examiners: The Varint Trap
Protobuf varints are not SQLite varints. Learn how to parse Protocol Buffer data from Apple Notes and mobile forensic artifacts, decode LEB128 varints step by step, and build a Python decoder with bitwise operations. Includes a hands-on XOR decryption challenge.
Elusive Data expands training formats to make digital forensics training more accessible
Making digital forensics training more accessible Elusive Data was founded in early 2024 with a clear purpose: to make advanced digital forensics training more accessible, so investigators can gain critical skills faster, understand complex data, and move cases forward with confidence. Elusive Data was created to offer training that adapts to those realities. Training […]
stay updated
Want to stay informed about new tools and updates?
Be the first to hear about new training opportunities, free tools, case-based blog posts, guides and practical insights. Our monthly newsletter is built to help you learn faster, solve cases smarter, and keep up in a field that never stands still.
Fill in your email to sign up.