Hi all — I want to be upfront: I built this tool and I'm sharing it here
because this community is exactly the audience I built it for. Not a sales
pitch — genuine request for feedback.
I kept seeing the same problem: solo DFIR consultants and small IR teams
either paying $3,000+/year for enterprise tools (EnCase, Magnet AXIOM, X-Ways)
or cobbling together free tools that aren't court-ready. There's a gap in the
middle that nobody has really filled.
Cyfirx is my attempt at that middle ground.
What does Cyfirx do
- Evidence acquisition and cataloguing with automatic MD5/SHA hash
verification
- Full chain-of-custody log — every action on every evidence item is
timestamped, recorded, and tamper-evident
- Court-ready report generation — structured output built around evidentiary
requirements
- Case management — run multiple investigations in parallel without mixing
evidence
- Completely offline — no cloud dependency, no data leaves the machine
whether it's worth anything.
1. For those of you doing solo or small-team forensics work: what's your
current tooling setup and what's the biggest gap in it?
2. Is court-ready chain-of-custody reporting something you actually need to
produce, or does it vary by jurisdiction/case type?
3. Is offline-first a feature that matters to you in practice?
4. What would make you switch away from whatever you're using now?
I'm early enough that honest criticism is far more useful than kind words. If
there's something obvious I've missed or got wrong, please say so.
Link: cyfirx.com
Thanks — Warner Lowe