FORENSIC ASSURANCE
Integrated Secure Data Erasure & Advanced File Recovery Tool for Digital Forensics and Data Sanitization
SYSTEM CAPABILITY RADAR
CAPABILITY MATRIX
Forensic Recovery
SleuthKit-powered inode discovery and block-level extraction with SHA-256 provenance verification.
Raw File Carving
Pure-Python signature carving with structure-based confidence scoring, including common legacy Office and email formats.
NIST Sanitization
Standards-informed erasure per NIST SP 800-88 Rev.2 and IEEE 2883. Fail-closed with honest scope.
Evidence Vault
Ed25519 cryptographically signed packages. RFC 8785 JCS canonical serialization. Tamper-evident.
Hash-Chained Audit
SHA-256 append-only audit chain. Chain-of-custody integrity verified in real time.
Independent Verifier
Standalone Ed25519 verification with zero database dependency. DB-free chain validation.
THREAT MITIGATIONS
| Threat | Defense | Status |
|---|---|---|
| Forged evidence package | Ed25519 signature + canonical hash | DEFENDED |
| Field tampering post-signing | JCS canonical SHA-256 recomputed before sig check | DEFENDED |
| Key substitution attack | Registry resolves keys by key_id — embedded keys ignored | DEFENDED |
| Torn writes / power loss | Atomic tempfile → fsync → os.replace() | DEFENDED |
| Unmanifested injected files | DEF-005 reverse directory walk detection | DEFENDED |
| Overstated erasure claims | VERIFIED_WITHIN_SCOPE + NAND disclaimer | DEFENDED |
STANDARDS & LEGAL COMPLIANCE
| Standard / Statute | Scope | Status |
|---|---|---|
| BSA 2023 §63(4) | Electronic-record certificate reference; legal sufficiency requires case-specific review | REFERENCE ONLY |
| NIST SP 800-88 Rev. 2 | Media sanitization reference — device-aware scope; physical execution not validated | SCOPE DOCUMENTED |
| IEEE 2883-2022 | Storage sanitization reference; standards conformance is not asserted | REFERENCE ONLY |
| RFC 8785 (JCS) | JSON Canonicalization Scheme — deterministic serialization before signing | IMPLEMENTED |
| RFC 8032 | Edwards-Curve Digital Signature Algorithm (Ed25519) | IMPLEMENTED |
| Former Indian Evidence Act 1872 §65B | Historical electronic-record provision; not a section of the Information Technology Act | TRANSITIONAL REVIEW |
01 Case Management
Create and manage forensic investigation cases with full chain-of-custody tracking.
New Investigation Case
Active Cases
No cases loaded. Create one or click refresh.
02 Forensic Recovery
SleuthKit-powered inode discovery, block extraction, and SHA-256 artifact verification.
Upload or Seed Evidence Image
Upload a forensic disk image (.img, .raw, .dd) or seed a built-in synthetic evidence disk with embedded JPEG, PNG, and PDF artifacts.
Drop evidence image here
or click Upload Image above
Filesystem Detection
Identify filesystem type and SleuthKit capabilities.
Inode Discovery
Scan for deleted file inodes using SleuthKit fls tool.
Artifact Recovery
Extract artifact bytes by inode using SleuthKit icat. Generates signed evidence envelope.
Anti-Forensics & Concealment Detection
Scan for deliberate evidence destruction: NTFS $SI vs $FN timestomping anomalies, Sysinternals SDelete/BleachBit residual traces, and crypto-shredding patterns.
🕵️ Steganography Detection
Chi-Square Proof-of-Value statistical analysis + Shannon entropy scan to detect LSB payload embedding in image/media sectors. Flags covert data exfiltration artifacts.
03 Raw File Carving
Signature-based structural carving on raw byte streams. No filesystem required.
Carving Configuration
Carving Results
Run carving to see discovered artifacts.
04 Sanitization & Eraser
NIST SP 800-88 Rev.2 & IEEE 2883-informed device-aware data erasure. Fail-closed with honest scope attestation.
NIST Device Profiler
Whole-Drive Sanitization
IRREVERSIBLESelective File Eraser
Scope-confined selective erasure of specific files within the case upload boundary. Multi-pass zero-fill + metadata scrub.
🔬 Forensic Proof Loop
7-STAGE ASSURANCEControlled in-memory validation: Seed → Pre-Carve → Zero-Fill Probe → Post-Carve → Differential Analysis → Signed Report. Does not sanitize or certify a physical device.
🔥 Physical Disposal Manifest
NIST DESTROYNIST SP 800-88 Rev. 2 §2.5 DESTROY branch — generates a physical-disposal record for media that cannot be cleared or purged via software. It documents handoff and witness fields but does not determine legal admissibility.
05 Audit Chain
SHA-256 append-only hash-chained audit log. Every event is cryptographically linked to the previous.
Chain-of-Custody Timeline
Select an active case and click Refresh to load the audit chain.
06 Evidence Vault
Cryptographically signed Ed25519 evidence envelopes. RFC 8785 JCS canonical serialization.
Technical Reliability Summary
Generate a technical implementation-status summary. Test error rates are not inferred, and the document is not an affidavit, statutory certificate, legal opinion, or admissibility determination.
🔴 Live Tamper Detection Demo
DEMO MODERun controlled audit-chain, artifact-byte, and key-substitution attacks against a selected demo case. Each action is verified; use Reset Demo Case to restore its pre-attack snapshot. This modifies stored demo data.
Signed Evidence Packages
No evidence packages loaded. Run forensics or carving to generate signed packages.
07 Independent Verifier
Standalone Ed25519 evidence package verification. Operates independently — no database, no case state required.
Evidence Package Verification
Paste a signed evidence package JSON exported from the Evidence Vault, or enter an Evidence ID to verify directly from the store.
Verification Result
Run verification to see the cryptographic validation result.
08 Live System Telemetry
Real-time forensic engine subsystem health, SMART drive indicators, and cryptographic module status.
Engine Subsystem Status
Click Refresh to load engine telemetry.