DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt, process inspection, lateral movement tracking, persistence detection, and VirusTotal enrichment.

A Linux version of Everything Search Engine.

From 2011: Quickly search for files in NTFS volumes parsing the Master File Table (MFT). A decent amount of how NTFS and MFT work was painstakingly reverse-engineered since it's undocumented.

Disk Usage Analyzer & Duplicate File Finder

Forensic analysis workstation — NTFS browser, file carving, timeline, keyword search, SQLite case management with evidence linking. Tauri v2 + Rust + SvelteKit.