FORENSIC EVIDENCE VIEWER / BY BBSOFT LLC
Free to download and use
Browse evidence. Examine Registry traces and event logs.
Follow recorded activity back to its source.
Keep your investigation together in a local case.
Closer to the detail.
01 / YOUR EVIDENCE WORKSPACE
Forensic Evidence Viewer brings file browsing, Windows Registry parsing, event log analysis and picture review into one desktop workspace. Open evidence read-only, follow recorded activity, and save your navigation, bookmarks and evidence references in a local case. Optional local AI search helps you find relevant files.
NEW IN 0.3.17
Collect memory from a Linux x64 endpoint with AVML, then analyze RAW or uncompressed LiME captures in the viewer. This release also expands iPhone backup analysis and filesystem investigation.
Generate a Linux x64 agent package with optional memory permission and bundled AVML. Follow capture activity, transfer and verification progress. Use Volatility 3 with symbols for the exact captured kernel build to inspect processes, command lines, sockets and modules. A banner scan helps identify the kernel before symbols are available.
AVML CAPTURE · RAW & LIME ANALYSISExplore Safari, Wi-Fi, Health and expanded call records in supported backups. Follow Wi-Fi locations on a map, play voicemail and optionally transcribe it offline. Encrypted backups have improved loading and retry feedback. Available artifacts depend on the backup; transcription requires a separate local runtime and model.
BROWSER, LOCATION & CALL RECORDSNavigate USN and ext journals, inspect allocation, and resume MFT searches with filename filters, timestamps and CSV export. Export selected files, folders and recovery candidates. A recovery candidate does not establish that deleted content is complete or recoverable.
SEARCH, NAVIGATE & EXPORTLinux memory collection requires root privileges, an explicitly enabled agent permission and a kernel that permits acquisition. Volatility 3 and matching kernel symbols are separate prerequisites. Linux ARM64 and macOS memory acquisition are not supported.
Read the full 0.3.17 release notes and validation details · Download 0.3.17
WINDOWS ARTIFACTS
Examine Windows Registry hives and EVTX event logs from your evidence on Windows, Linux or macOS. Start with focused artifact views, then open the source records to investigate the details.
Scan standard Registry locations or choose Search all folders. Review USB history and UserAssist records of application activity. Optional deleted-cell recovery and .LOG1/.LOG2 transaction-log replay expose additional surviving data, with added or changed replay results highlighted. Search, sort or load all matching entries in the Registry grid.
HIVES READ FROM YOUR EVIDENCERead EVTX files and review summaries of logons, remote access, log clearing, account changes, service installations, scheduled tasks and process activity. Investigate PowerShell, Microsoft Defender, Sysmon, credential use, network shares, system lifecycle and clock changes. The coverage overview shows which summaries are available in the scanned logs.
ACTIVITY YOU CAN TRACE TO A RECORDExplore RDP sessions and confirmed Windows logon histories with related privilege and network-share activity. Follow Sysmon process links when those records exist, and reconstruct multipart PowerShell script blocks. Filter by recorded activity, resize columns, and open supporting events without losing your activity filter.
FROM SUMMARY TO SUPPORTING EVENTCoverage depends on the hives, event providers and records present in the evidence. Deleted-cell recovery and log replay depend on usable surviving data. Confirmed logon histories are shown; uncertain partial histories remain hidden. Review the underlying records when interpreting activity.
02 / BUILT FOR A CLOSER LOOK
Navigate supported E01, Ex01, L01, Lx01, AFF4, raw images, VMDK and DMG, or open an extracted folder. Native EWF and AFF4 readers are included.
EVIDENCE OPENED READ-ONLYMove between table and gallery views. Inspect pictures, EXIF metadata and available GPS coordinates, with map links and a GPS-only gallery filter. Preview photo locations on a map.
FILES, PICTURES & METADATAClick a path breadcrumb to jump to a parent folder. Back and Forward restore visited folders and file selections. Save bookmarks and multiple evidence sources together in a local case.
PICK UP WHERE YOU LEFT OFFInspect hex and text, search ASCII or HEX strings, and extract supported documents such as PDF and DOCX to Markdown in the Transcript tab.
BYTES TO READABLE CONTENTOptionally process documents and pictures with Ollama, store the index in the case’s SQLite database, and ask for matching files in a results table.
LOCAL PROCESSING, LOCAL INDEXChoose light or dark appearance, and switch between English, Simplified Chinese and Traditional Chinese. Use the same interface across supported platforms.
THREE PLATFORMS. ONE WORKSPACE.Create iPhone USB backups on Windows, or collect accessible Android files on Windows, Linux and macOS. An optional Android app exports permitted messages, contacts and call history. Follow collected bytes and verification progress. See the collection screens.
LOGICAL COLLECTION, VISIBLE PROGRESSBrowse iPhone backup messages, contacts and available call history. Inspect backup folders with file counts, hide empty folders and search below the current folder. Drill into standalone or nested PST/OST and Exchange 2013+ EDB mailboxes.
PHONE RECORDS & MAILBOXESCollect a disk on Windows, Linux or macOS as RAW, compressed E01 or physical AFF4. Capture memory on Windows or from a Linux x64 endpoint with AVML. Completed output receives SHA-256 read-back verification; canceled collections retain partial files.
EXPERIMENTAL PC ACQUISITIONFormat support depends on the container variant and filesystem. Read-only filesystem support includes exFAT, experimental APFS v2 and single-device Btrfs. NTFS deleted-file scanning can recover supported surviving MFT records; recovered content requires review. APFS unlocking, snapshots and Fusion drives, multi-device Btrfs RAID, and fragmented carving are not supported. Basic contiguous JPEG/PNG carving is disabled by default. Experimental disk and mobile acquisition are available. Coverage depends on the device, filesystem and permissions.
PHOTO LOCATIONS
Forensic Evidence 0.3.14 adds photo previews to Map filtered locations. Bring your filtered GPS records into one view, hover a marker for a thumbnail, or click to keep the picture and recorded details open. Select the screenshot to view it at full size.
Hover to see a thumbnail. Click to keep a larger photo preview open with its filename, recorded capture time and coordinates.
When several records overlap at a marker, use the previous and next buttons to review each picture or location record.
Choose Show source file to jump back to the original item in its evidence source and continue your examination.
Photo previews are read locally from evidence. The map provider receives the viewed map area, not photo bytes or evidence paths. GPS pins are recorded claims, not proof of a person's presence or a travel route.
03 / MOBILE ACQUISITION · NEW IN 0.3.11
See the iPhone and Android collection screens, verification progress and mobile evidence preview. These screenshots show the actual 0.3.11 interface with synthetic demo data; progress values and time estimates are illustrative. Select an image to view it at full size.
ALSO IN THE WORKSPACE / LOCAL AI SEARCH
Describe what you are looking for in natural language. Documents and pictures processed into the case index are searched together.
Matches come back in a results table with scores and the reason each file matched, so you can judge the lead before you open it.
Select a match to highlight the file in its evidence source and inspect the original bytes, text or picture yourself.
AI descriptions and matches can contain errors. Review the original evidence; results are a shortlist, not an exhaustive search or a forensic conclusion. See the AI setup guide for model requirements.
04 / GET THE DESKTOP APP
Free to download and use. Desktop preview · Version 0.3.17 for Windows x64, Linux x64 and macOS Apple Silicon · Downloads hosted on GitHub.
01 / WINDOWS
x64 · Intel & AMD
Windows 10 or later
64-bit x86 processor
MSI installer · 367 MiB (384,696,320 bytes)
Publisher-signed and timestamped by BBSOFT LLC. Windows may still display a reputation warning for new releases.
Run the MSI installer, then open Forensic Evidence from the Windows Start menu. The application runtime and evidence readers are included. A signed portable ZIP is also available; extract the complete archive before launching.
Legacy Windows ARM64 ZIP (0.3.6) · 207 MB. Extract all files before launching. An ARM64 MSI is not available. Requires Windows 11 with x64 subprocess emulation; not runtime-tested on ARM64 hardware.
02 / LINUX
x64 · Intel & AMD
Ubuntu 22.04+ or compatible
glibc 2.35+ · Graphical desktop
TAR.GZ archive · 488 MiB (511,369,890 bytes)
System display and font libraries are required. Installation details are in the archive’s README.
03 / MACOS
ARM64 · Apple Silicon
macOS 14 or later
Apple M-series processor
TAR.GZ archive · 384 MiB (402,706,509 bytes)
Ad-hoc signed, not Apple-notarized. macOS may block the first launch. Move the app to Applications; for disk acquisition, grant Full Disk Access to that installed copy. Intel Macs are not supported.
Verify your download. Compare its SHA-256 hash with the 0.3.17 checksums. The legacy Windows ARM64 0.3.6 checksums remain available.
Packages include third-party license notices. Third-party sources for 0.3.17 (652 MiB) · Source checksum
View the latest release on GitHub for release notes and desktop downloads.
Optional Linux x64 memory acquisition with AVML; standalone LiME images and Linux Volatility 3 analysis with kernel symbol selection; expanded iPhone artifacts; journal navigation, resumable MFT search and direct file/folder export. Fixes improve Windows containment setup, NTFS mounting, EWF opening, preview layout and Linux-compatible checksum files. Read the full 0.3.17 release notes on GitHub.
Registry parsing with USB history, UserAssist, deleted-cell recovery and transaction-log replay; EVTX investigative summaries, linked session histories and multipart PowerShell reconstruction. Read the full 0.3.16 release notes on GitHub.
iPhone USB backup acquisition and examination, Android logical collection with an optional permission-based collector, best-effort provider-exposed RCS message copies, mobile transfer and verification progress, backup folder counts and search, clickable breadcrumbs, and Back/Forward navigation for folders and file selections.
Signed Windows x64 MSI installer with a bundled APFS reader, read-only exFAT browsing, custom bookmark notes, and basic JPEG/PNG file carving that is disabled by default.
HEIC and camera RAW previews, pasted picture and document references for AI search, per-file indexing status, and faster picture processing with a separate description model.
Timeline view with a zoomable histogram, progressive gallery scanning, and collapsible side panes.
PST email, Apple DMG, VMDK and read-only ext4 readers; whole-source gallery; detachable workspace windows.
First public release: E01, Ex01, L01, Lx01, AFF4 and raw images, bookmarks, local cases, and optional local AI search.
Install Ollama, download the required models, and process your first case. Includes Windows, macOS and Linux instructions, troubleshooting and a downloadable README.
05 / GET STARTED
The application runtime and evidence readers are bundled. AI features are optional and require a separate local model setup.
On Windows x64, run the MSI installer and launch Forensic Evidence from the Start menu, or extract the complete portable ZIP. On macOS, extract the archive, move the included .app to Applications and launch it. On Linux, extract the archive and run ./ForensicEvidence.Desktop. Keep archive contents together.
Choose an evidence file or extracted folder. Create a case folder to save evidence references, item bookmarks and your workspace. Save the case before closing.
Install Ollama separately with nomic-embed-text for embeddings, gemma4:12b for AI queries, and qwen3-vl:2b-instruct for picture descriptions. In a case, open AI search, choose Process evidence, then enter your query. Model downloads are not included.
Read the Ollama & AI setup guide
AI descriptions and matches can contain errors. Review the original evidence; results are a shortlist, not an exhaustive search or a forensic conclusion.
06 / QUESTIONS
Common questions about the viewer, its platforms, and how it treats your evidence. For anything else, contact BBSoft.
Yes. Forensic Evidence Viewer is free to download and use on Windows, Linux and macOS. Version 0.3.17 packages for Windows x64, Linux x64 and macOS Apple Silicon are published with SHA-256 checksums so you can verify each download.
Version 0.3.17 supports Windows 10 or later (x64), Ubuntu 22.04 or compatible Linux (x64, glibc 2.35+), and macOS 14 or later on Apple Silicon. A legacy Windows ARM64 0.3.6 download remains available; it requires Windows 11 with x64 subprocess emulation and has not been runtime-tested on ARM64 hardware. Intel Macs are not supported.
Evidence containers are opened read-only. Physical-disk acquisition opens the source read-only; logical mobile acquisition communicates with the device, and installing the optional Android collector changes device state. Opening a live folder can update operating-system timestamps, so examine copies or mounted images and use a write blocker where appropriate.
E01, Ex01, L01, Lx01, AFF4, raw images, uncompressed LiME memory images, VMDK, DMG, PST/OST, Exchange 2013+ EDB, iPhone backups and Android collections, plus extracted folders. Read-only filesystem support includes exFAT, experimental APFS v2 and single-device Btrfs. NTFS deleted-file scanning can recover supported surviving MFT records; recovered content requires review. APFS unlocking, snapshots and Fusion drives, multi-device Btrfs RAID, and fragmented carving are not supported. Basic contiguous JPEG/PNG carving is disabled by default.
No. AI search is optional and runs through your local Ollama installation. Processing and the search index stay on your machine, stored in the case’s SQLite database.
iPhone USB backup acquisition requires Windows and installed Apple device drivers/services; the Apple Devices window does not need to remain open. Android USB collection requires separately installed Android SDK Platform-Tools, USB debugging and device approval. The optional collector requires Android 8 or newer, explicit permissions and a user-started export. It collects provider-exposed messages; complete RCS history and private app data are not guaranteed. If a development collector is installed, uninstall it before installing the release collector; computer-side collections remain available.
Yes. From the desktop, open Acquire → Manage remote endpoints to generate an agent package for a supported Windows, Linux or macOS computer. Install and enroll the agent, then browse its permitted files and folders, select what you need, and collect it to your investigator computer over an authenticated, encrypted connection.
File and folder collections create a verified Lx01 logical image with hashes, signed receipts and acquisition records. Physical-disk acquisition and memory capture require separate permissions and selection. Memory capture supports Windows and Linux x64 endpoints; Linux packages include AVML and require root privileges and a kernel that permits acquisition. Available sources depend on the endpoint and its permissions; macOS file collection remains experimental.
Registry analysis parses raw hive files from the selected evidence image or extracted evidence folder. It scans standard Registry locations by default, with an optional Search all folders mode. USB history, UserAssist, deleted-cell recovery and transaction-log replay are derived from those evidence files; the scan does not substitute the investigator computer's live Registry.
The Event Logs tab reads EVTX files from the evidence and summarizes supported recorded activity, including logons, remote access, account and service changes, scheduled tasks, PowerShell and Microsoft Defender. Open supporting events to review the underlying records. Available summaries and session links depend on the logs and auditing present; Sysmon summaries require Sysmon events in the evidence. Uncertain partial logon histories remain hidden.
FORENSIC EVIDENCE VIEWER · BBSOFT LLC
Product inquiries & support
support@bbsoftllc.comFor a technical issue, include your operating system, application version and error message. Please do not email evidence files.