Pyflag

PyFlag is a web-based, database-backed forensic and log analysis GUI and Computer forensics framework written in Python. PyFlag stores disk images in numerous file formats, including raw, sgzip, AFF, and EnCase format.

PyFlag is no longer maintained.

Features

Supported File Systems

PyFlag uses The Sleuth Kit for file system support.

File Search Facilities

• Lists allocated and unallocated files.
• Sorts files by type.
• Searches for keywords.
• Works with compressed zip files.

Historical Reconstruction

Can it build timelines and search by creation date?

• Creates a "case file".

Searching Abilities

• Searches for keywords.
• Builds an index.

Hash Databases

• Hashes and compares with Hashkeeper using MD5.

History

• Originally started by the Australian Department of Defence, it was later open sourced

See Also

• The Sleuth Kit
• Computer forensics framework
• Hashkeeper

External Links

• Github: Pyflag
• Google code: Pyflag
• Sourceforge: Pyflag