ForensicGuardForensicGuard
checking

Does this file deserve a closer look?

Drop a file, an image or an email. ForensicGuard inspects it without opening it, gathers objective indicators, and explains every point it assigns.

Drop evidence here

or select a file from your computer

JPG · PNG · PDF · EML · DOCX · ZIP · EXE and more

Any file

  • MD5, SHA-1, SHA-256, SHA-512
  • Shannon entropy and entropy map
  • Real format from magic bytes
  • Extension vs signature mismatch
  • URLs, IPs, paths, LOLBins

Images

  • Dimensions and colour mode
  • Full EXIF metadata
  • Camera make and model
  • Editing software
  • GPS coordinates

Emails (.eml)

  • Headers and Received chain
  • SPF, DKIM and DMARC
  • Reply-To and Return-Path checks
  • Links that hide their destination
  • Attachments analysed recursively

Risk score

Every indicator that fires adds points, capped at 100. Each one carries the evidence that triggered it — a number without a justification is an opinion, not a finding.

0 – 20low
21 – 50medium
51 – 75high
76 – 100critical

What happens to your file

  • It never leaves your machine — the analysis runs on the backend you started yourself.
  • Nothing is executed. No macro runs, no image is decoded, no address is contacted.
  • It is written to a temporary file with a generated name and deleted when the analysis ends — including when it fails.
  • No database, no account, no history.

Static triage based on indicators and heuristics. Not a definitive malware or phishing verdict.