Notifications
Clear all
Topic starter
13/10/2026 12:11 am
Hi all — I'm Qi, developer of BBSoft Forensic Evidence Viewer, a free
desktop tool for first-pass review of a drive or folder: file
browsing, hex viewer, EXIF/GPS metadata, picture gallery,
PST/DMG/VMDK/ext4 readers, and local AI-assisted indexing and search
(via Ollama, installed separately). Latest release is v0.3.14.
Recent additions:
- BitLocker volumes with a usable clear-key protector now open
automatically (including Suspended / Waiting for Activation); other
locked volumes prompt for a recovery key when opened. Keys stay masked
and session-only.
- Internet artifacts: Chromium/Edge/Firefox/Safari visit history,
Chromium Simple Cache, photo EXIF GPS, and Google Timeline JSON
imports, with recorded locations plotted on a map and provenance
exportable as JSON.
- Chromium IndexedDB / Local Storage / LevelDB parsing, including
ChatGPT, Discord, and Codex data (opt-in — disabled by default to keep
scans fast; Firefox/Safari IndexedDB not yet parsed).
- Mount selected evidence or all open sources as a read-only Windows drive, so you can browse files in Explorer and examine them with external tools. Files are read on demand without exporting the entire evidence set, while the mounted drive blocks writes, deletion and renaming to preserve the original evidence.
- Mount selected evidence or all open sources as a read-only Windows drive, so you can browse files in Explorer and examine them with external tools. Files are read on demand without exporting the entire evidence set, while the mounted drive blocks writes, deletion and renaming to preserve the original evidence.
- Experimental mobile acquisition: iPhone USB backup acquisition on
Windows (messages/contacts/call history in a browsable backup tree;
requires Apple drivers/services); Android USB logical collection via
adb on Windows/Linux/macOS, plus an optional phone-side collector app
(Android 8+, no root, permission-gated).
- Experimental disk acquisition (RAW, compressed E01/AFF4 with SHA-256
read-back verification), Windows memory capture, NTFS deleted-file
recovery via MFT scan, whole-source Timeline view, PDF reports from
bookmarks.
Product page: https://www.bbsoftllc.com/forensic-evidence/
Downloads with SHA-256 checksums:
Honest scope: acquisition is new and experimental — read-only source
handle, SHA-256 read-back of the saved stream, no atomic live-disk
snapshot; memory capture is Windows-only, iPhone acquisition is
Windows-only. IndexedDB parsing is opt-in and Chromium-only for now.
Not a write-blocker replacement. Windows builds are publisher-signed
by BBSOFT LLC (Microsoft Trusted Signing, timestamped); macOS builds
are ad-hoc signed, not yet Apple-notarized.
It's the fast first look before you reach for the full suite. I'd
genuinely appreciate practitioner feedback: what would make a triage
viewer actually useful in your workflow? Happy to answer technical
questions. — Qi, BBSoft LLC (bbsoftllc.com)
This topic was modified 8 hours ago by BBSoft