Snorkel is a Java software library that is used by developers of forensic software. Snorkel is not a standalone forensic application, but it is an important piece of infrastructure that can be used by many forensic applications: Snorkel gives access to digital evidence files, file systems, files, slack space, unallocated clusters, etc. This type of access is a key enabler in the development of forensic software systems, ranging from single-purpose stand-alone tools to integrated forensic processing systems.
Snorkel is developed by the Netherlands Forensic Institute
Features
Snorkel recognizes and gives access to numerous storage formats for digital evidence, disk partitioning schemes, volume managers, file systems, and structured files. The formats supported are summarized below.
Image File Formats Understood
| Image file formats | EnCase |
| RAW (dd) | |
| VMWare (vmdk) |
File Systems Understood
| Volume managers | Windows (ldm) |
| Partitioning schemes | PC/MBR |
| Apple | |
| GPT | |
| BSD | |
| File systems | Windows (fat, NTFS) |
| Apple (mfs, (Classic) HFS, HFS+) | |
| Linux (ext, Reiser) | |
| Solaris, BSD (ufs) | |
| CD (ISO9660) | |
| File Formats | Windows registry (Win 9x, NT) |
| Microsoft Office (OLE2) |
License Notes
Snorkel is has a proprietary license. An evaluation version is available from the website.