Link to the latest OpenForensics Installable Windows Builds: https://github.com/ethanbayne/OpenForensics/releases

OpenForensics is an open-source OpenCL Digital Forensics analysis and file carving tool. This prototype tool was built in conjunction with PhD research from Dr Ethan Bayne as a platform to demonstrate the performance enhancements possible when employing asynchronous GPU processing and an optimised PFAC algorithm to the problem of string searching within a digital forensics context. Details of the supporting research can be found in the completed thesis by Dr Ethan Bayne. (Bayne, E. (2017). Accelerating digital forensic searching through GPGPU parallel processing techniques. PhD thesis. Abertay University.)

The refined pattern matching technique employed by OpenForensics was also presented at DFRWS EU 2018. The conference proceedings can be found in Digital Investigation. (Bayne, E., Ferguson, R. I., & Sampson, A. T. (2018). OpenForensics: a digital forensics GPU pattern matching approach for the 21st century. Digital Investigation, 24(Suppl.), S29-S37. DOI: 10.1016/j.diin.2018.01.005)

This prototype tool was built using C# and Cudafy.NET (https://cudafy.codeplex.com/). Currently, the file carving provided by this tool is considered basic (carves data between found header and footer). Whilst it is intended to develop more advanced file carving features in time, we would welcome collaborators to help build upon the functionality of the tool.

Basic Usage (v.1.78b onwards)

1. Provide a case reference and evidence reference. (Optional)
2. Select either a physical drive or a file to perform physical searching on.
3. Select file-types or keyword targets.
4. Choose processing technique. (Optional - GPU usage recommended)
5. Choose whether you would like to generate a live preview of JPG images found during searching. (Optional - High RAM usage with large datasets and may decrease searching speed)
6. Click Analyse.
7. Choose location to save results.

OpenForensics will create a set of sub-folders and files to store results. The directory and file hierarchy created is:

<save-location>
  └─ <case-reference> default:"OpenForensics Output"
     └─ <evidence-reference> default:file/drive name
        ├─ LogFile.txt
        ├─ CarvableFileData.of
        └─ <Folder of each file-type carved>
           └─ <Files carved>

If data exists for the case and file/storage device, an option will present itself to query whether you want to reproduce files using existing results. Selecting No will prompt whether you want to overwrite the existing results with a new search. Warning: Old results will be erased when proceeding.

File-types are populated from the FileTypes.xml file. OpenForensics will load the file-types specified in this file when the program launches. Each file-type specified in FileTypes.xml should have values for:

1. Type - (Image/Video/Audio/Document/Misc) - used to categorise file types for batch searching.
2. Name - Used as a file identifier and also for file extension for carved files.
3. Value - File header in byte format without spaces (e.g. FFD8FFE00010).
4. EOF (Optional - Required for file carving) - File footer in byte format without spaces (e.g. FFD9).
5. MaxLengthMB (Optional) - Specifies the maximum file length for the type of file (Default: 10 MiB).

Open-source License

OpenForensics Copyright © 2016 Ethan Bayne

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at:

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

---

This software includes CUDAfy .NET (Cudafy.NET.dll), developed by Hybrid DSP.

The LGPL v2.1 License applies to CUDAfy .NET. If you wish to modify the code then changes should be re-submitted to Hybrid DSP. If you wish to incorporate Cudafy.NET into your own application instead of redistributing the dll's then please consider a commerical license. Visit http://www.hybriddsp.nl. This will also provide you with priority support and contribute to on-going development.

Cudafy.NET also utilises the following libraries are made use of: The MIT license applies to ILSpy, NRefactory and ICSharpCode.Decompiler (Copyright (c) 2011 AlphaSierraPapa for the SharpDevelop team). Mono.Cecil also uses the MIT license (Copyright JB Evain). CUDA.NET is a free for use license (Copyright Company for Advanced Supercomputing Solutions Ltd)