Skip to content

Snorkel is a Java software library that is used by developers of forensic software. Snorkel is not a standalone forensic application, but it is an important piece of infrastructure that can be used by many forensic applications: Snorkel gives access to digital evidence files, file systems, files, slack space, unallocated clusters, etc. This type of access is a key enabler in the development of forensic software systems, ranging from single-purpose stand-alone tools to integrated forensic processing systems.

Snorkel is developed by the Netherlands Forensic Institute


Snorkel recognizes and gives access to numerous storage formats for digital evidence, disk partitioning schemes, volume managers, file systems, and structured files. The formats supported are summarized below.

Image File Formats Understood

Image file formats EnCase
RAW (dd)
VMWare (vmdk)

File Systems Understood

Volume managers Windows (ldm)
Partitioning schemes PC/MBR
File systems Windows (fat, NTFS)
Apple (mfs, (Classic) HFS, HFS+)
Linux (ext, Reiser)
Solaris, BSD (ufs)
CD (ISO9660)
File Formats Windows registry (Win 9x, NT)
Microsoft Office (OLE2)

License Notes

Snorkel is has a proprietary license. An evaluation version is available from the website.

External Links