Description
Examines disks, filesystems, and media images for forensic analysis, deleted-file recovery, timelines, and evidence review. Investigators and administrators use it to inspect storage without relying on the original operating system view.
Forensic tools can expose private files, deleted data, and sensitive metadata. Use them only with authorization, preserve evidence carefully, and avoid writing to original media during analysis.