ForenseKit — Digital Forensic Intelligence Tool

Installation

Linux / macOS

$ curl -fsSL https://forensekit.fdevpe.com/install | bash

Or manually: download the .tar.gz, extract, and run bash install.sh

Windows

Download the .zip, extract, and run install.bat

First Run

$ forensekit --version

$ forensekit info

$ forensekit quick # 1-second scan

License Activation

$ forensekit license activate --file license.key

$ forensekit license status

The free Demo requires no license key. Limited to 3 cases.

Basic Workflow

1. Collect Evidence

$ forensekit collect --target live-triage --output ./my-case \

--contractor "ACME Corp" --subject "Server-01" --purpose technical

2. Full Pipeline

$ forensekit auto --target live-triage --output ./my-case --report html

3. Review Results

$ forensekit summary --input ./my-case

$ forensekit tui --input ./my-case # Terminal UI

$ forensekit console --output ./my-case # Web GUI at :8080

System/App Audit Complete+

$ forensekit sys-audit --name "ERP Ventas" -t erp \

--database /path/to/db --logs /path/to/logs --config /path/to/config

USB Portable Collector

# Create portable (from Full Install)

$ forensekit portable create --path /media/usb --expires 2026-05-20

# On target machine (no install needed)

$ ./forensekit collect --target live-triage --output ./evidence

All Commands

Command	Description
collect	Collect artifacts from local system
ingest	Analyze external evidence
quick	1-second system assessment
auto	Full pipeline (collect→report)
parse	Parse artifacts into findings
analyze	Detection engine + scoring
hunt	Search IOCs (IP/hash/domain)
search	Keyword search across evidence
timeline	Cross-artifact event correlation
report	HTML/JSON professional report
brief	Quick client summary
tui	Interactive terminal dashboard
console	Web-based GUI console
sys-audit	System/app audit [Complete+]
hash	SHA-256 + MD5 + BLAKE3
portable	USB portable collector
compare	Diff two cases
export	Package for delivery
watch	Continuous monitoring
doctor	System health check

System Requirements

Platform	Minimum
Linux	x86_64, glibc 2.17+ (Ubuntu 18.04+)
macOS	ARM64 (Apple Silicon M1+)
Windows	x86_64, Windows 10+
RAM	30 MB
Disk	10 MB
Internet	Required for activation only

Support

Email: contacto@fdevpe.com

Website: forensekit.fdevpe.com

Quick Start Guide