digital forensics tools
Forensic tools that fill the missing pieces
Discover tools that turn chaos into clear, usable evidence
varint decoding made easy
VarInt Calculator.
A tool for calculating and decoding VarInts.
Instantly decode variable-length integers from SQLite databases, identifying the lengths of cells, strings, and blobs. This utility converts varint hex values to decimal in seconds, perfect for analyzing app databases and parsing records for accurate serial type decoding.
make the invisible visible
Coming soon:
SQLite Visualizer
A new way to explore SQLite is on its way. Built from years of forensic training and real-world investigations, SQLite Visualizer transforms how you analyze mobile databases. Trace deleted records frame by frame. Map complex schema relationships visually. Recover evidence from WAL files and unallocated space through an intuitive interface designed for modern investigations.
From backup chaos to file system
Backup 2FS. A free tool to parse and normalize files from iOS backups.
Transform iOS backup data into organized, navigable file structures. This free Windows tool normalizes iTunes backup content, complete with hash verification and device metadata. Access your backup data through a clear, logical file system ready for efficient analysis and reporting.
FAQ
Frequently Asked Questions
We’ve trained thousands of professionals, and these are the most common questions we hear before they enroll, from what’s in the course to how it fits into busy caseloads.
Our tools are built to meet today’s forensic challenges. They don’t replace your trusted platforms — they extend them. Some give you quick answers when time is short, others open up evidence in ways no other tool can.
VarInt Calculator – Decode variable-length integers instantly from SQLite databases. No scripts, no guesswork. Just clear values when you need them.
Backup2FS – Transform iOS backups into structured, navigable file systems with hashes and metadata preserved. From confusion to clarity in one step.
SQLite Visualizer – A full forensic suite for database analysis. Visualize structures, follow deleted records across time, and recover hidden evidence from WAL, freelists, and unallocated space. Built from years of training and investigations, it reveals what standard tools often miss.
Together, these tools give you sharper insight, clearer reporting, and results that hold up in real investigations.
We built SQLite Visualizer because we needed a clearer way to investigate SQLite in real cases. Again and again, the same questions appeared: What was deleted — and when? Where did this record come from? How can I explain this in a report?
The tool fills that gap. It shows deleted records frame by frame, maps schema relationships as a visual canvas, and recovers data from WAL, freelists, and unallocated space. Born from casework and refined in hands-on labs, SQLite Visualizer makes forensic analysis faster, clearer, and easier to explain — especially when time is short.
SQLite Visualizer is not another database viewer — it’s a new way to explore forensic questions. Instead of rows and hex, you see the story inside the database.
Key capabilities include:
WAL Timeline Viewer – Watch database history unfold, record by record.
Smart Canvas Navigation – Visualize entire schemas as interactive maps.
Integrated Hex & Structure View – Explore freelists, overflow chains, and pages without losing context.
One-Click Recovery – Extract deleted data from WAL, freelists, and unallocated space.
Built-in Evidence Tools – Protect source data, verify with SHA1, and generate reports.
Shaped by real-world challenges and used in our certified SQLite training, ED SQLite Visualizer gives investigators a faster, more connected way to see what’s really in the data.
Our tools are designed for digital forensic examiners, law enforcement professionals, corporate investigators, and incident response teams. They provide clarity and speed in cases where time and precision matter most.
Backup2FS are free and available to the forensic community. SQLite Visualizer will launch in October as a professional product. Pricing and licensing options will be available upon launch, with opportunities to request a demo or sign up for launch notifications.
Each tool is designed with clarity and integrity in mind. For example, Backup2FS provides file integrity verification with hash algorithms, and SQLite Visualizer includes built-in evidence preservation and reporting. This ensures your findings hold up under scrutiny.
VarInt Calculator and Backup2FS are currently available for Windows. SQLite Visualizer will also launch first on Windows, with potential expansion depending on community needs.
Absolutely. These tools are shaped by real-world challenges and user feedback. Investigators and students often inspire the features we build, so suggestions are always welcome.