🕵️‍♂️ DataDetective

Unlock the story hidden in data.
Your digital investigation partner.

📜 Table of Contents

Click to collapse/expand

1. 📖 About
2. 🛠️ Installation
3. 🎮 Usage
4. 📜 License
5. 📞 Contact

📖 About

⚠️ DataDetective is a work in progress

Although already useful in specific forensic investigation scenarios, the project is still far from complete. The current version serves as a foundation for what will eventually become a much more powerful, versatile, and feature-rich forensic analysis tool.

What is DataDetective

DataDetective is a Python-based tool designed to extract, analyze, and interpret forensic evidence from EWF disk images and raw storage dumps. It aims to provide investigators with a reliable and efficient method to uncover critical data for forensic analysis.

(🔼 Back to top)

🚀 Installation

Prerequisites

• Linux (Tested on Debian GNU/Linux 12 Bookworm, but should work on other distributions).
• Python 3 (latest stable version recommended).
• The Sleuth Kit (TSK) - Essential for forensic disk analysis.
• RegRipper - Critical for extracting Windows registry artifacts.

Getting DataDetective

Option 1: One-liner with Invoke-WebRequest (Recommended)

curl -O https://github.com/franckferman/DataDetective/blob/stable/src/DataDetective/DataDetective.py

Option 2: Clone via Git

git clone https://github.com/franckferman/DataDetective.git

Option 3: Direct Download from GitHub

1. Go to GitHub repo.
2. Click <> Code → Download ZIP.
3. Extract the archive to your desired location.

(🔼 Back to top)

🎮 Usage

Getting started

Once installed, you can start using DataDetective with the following commands:

❔ Get Help:

python3 DataDetective.py -h

⚖️ Check Image Integrity:

python3 DataDetective.py -i image.ewf --check-image

📋 List Image Partitions:

python3 DataDetective.py -i image.ewf --show-partitions

📁 List Partition Files:

python3 DataDetective.py -i image.ewf --show-files
python3 DataDetective.py -i image.ewf --show-files -r  # Recursive listing

🗂️ Show a Specific Directory:

python3 DataDetective.py -i image.ewf --show-dir /path/to/directory

🔎 Extract Data:

python3 DataDetective.py -i image.ewf -e ALL -o /path/for/output

(🔼 Back to top)

📚 License

This project is licensed under the GNU Affero General Public License, Version 3.0. For more details, please refer to the LICENSE file in the repository: Read the license on GitHub

(🔼 Back to top)

📞 Contact

(🔼 Back to top)