ForensicGuardForensicGuard
Analyse
ForensicGuard
ForensicGuard

Know what a file really is

Forensic triage that inspects files, images and emails without ever opening them.

33
formats recognised
27
risk rules
320
backend tests
Start analysis
  • never leaves your machine
  • no database
  • no account
See how it works

Five passes over the evidence, and none of them opens the file

01

Fingerprint

MD5, SHA-1, SHA-256 and SHA-512 in a single streaming pass. Identifies the file without revealing its contents.

02

Entropy

Shannon entropy overall and per block. A packed section shows up as a plateau the average hides.

03

True format

33 magic byte signatures. The extension is a claim; the first bytes are the fact.

04

Artifacts

Readable text in ASCII and UTF-16, then URLs, IPs, paths and references to command interpreters.

05

Risk score

16 rules turn observations into points, each carrying the evidence that triggered it.

Four kinds of evidence, a single risk scale

Any file

  • Executable disguised as a document or image
  • Extension that contradicts the real signature
  • Entropy unexpected for the detected format
  • References to PowerShell, certutil and other LOLBins
  • Embedded URLs, IP addresses and Windows paths

Images

  • Camera make, model and capture time
  • Editing software left in the metadata
  • GPS coordinates, with a link to the map
  • Decompression bombs, caught without decoding a pixel
  • Dimensions, colour mode and every readable EXIF tag

Emails

  • SPF, DKIM and DMARC verdicts as the receiving server recorded them
  • Reply-To or Return-Path pointing elsewhere
  • Links that display one address and lead to another
  • Each attachment analysed recursively, with its own score
  • The full Received chain, one of the few headers a sender cannot write

Links

  • Credentials hiding the real host before the @
  • Mixed alphabets, a Cyrillic character inside a Latin name
  • Top-level domains that collide with file extensions, like .zip
  • Double extensions such as invoice.pdf.exe
  • The address dissected part by part, showing where it truly leads

Every point comes with the evidence behind it

invoice.jpg, a renamed executable
$ forensicguard analyse invoice.jpg
 
  sha256    7a467a30ee59de80e7d4b384581e192ee5111b48...
  entropy   5.1161 / 8.00
  declared  .jpg
  detected  Windows executable (PE / MZ)
 
  RISK 85/100  CRITICAL
    +50  executable disguised as another file type
    +35  extension does not match the detected signature

Built for files that are hostile by definition

Runs on your machine

No account, no database, no upload to anyone else. The backend is the one you started yourself, and the evidence is deleted the moment the analysis ends, including when it fails.

Nothing is executed

No macro runs, no image is decoded, no archive is extracted. Files are read in 64 KB blocks, and every parser that touches hostile input is wrapped and bounded.

Nothing is contacted

No DNS lookup, no certificate fetch, no page request. Querying a suspicious address tells whoever built it that they are being investigated, so the analysis stays structural.

What this tool does not do

ForensicGuard performs static triage. It answers whether something deserves a closer look, never whether it is malware. A clean result means nothing stood out, which is not the same as being safe.

  • Does not run the file in a sandbox
  • Does not query reputation services
  • Does not decrypt or unpack archives
  • Does not replace an antivirus
  • Does not issue verdicts, only indicators
  • Does not keep history of what you analysed