Cinder
Open source. What remains tells the story.Digital forensics in one modern app.
Cinder brings the work of Autopsy, FTK Imager, the Eric Zimmerman tools, Volatility, Hindsight, ExifTool, Plaso, and WinHex into one application with one case format and one workflow. It is built for forensic examiners, incident responders, security students, and anyone running a home lab.
At a glance
- Current version
- 0.2.2
- License
- Apache 2.0, free
- Runs on
- Windows 11 and Linux
- Built with
- .NET 10 and Avalonia 11
Where it stands today
Cinder is pre-alpha, and already useful. Most parsers and the core case workflow work end to end against real evidence today. Signed kernel drivers, the memory forensics pipeline, and package manager installs are still on the roadmap.
Working now
- Disk imaging to raw, E01, AFF4, VHD, and VHDX, with hashing as it reads
- A hex viewer that opens 100 GB images instantly
- NTFS, FAT, ext2 to ext4, and ISO 9660 filesystems, plus file carving
- Linux artifacts: shell history, auth and system logs, cron, and SSH known hosts
- Case-wide full-text search, YARA scanning, and a map of photo locations
- PDF and Word reports with a hash-chained chain of custody
In progress
- Windows artifacts (registry, event logs, prefetch, and more) parse today but are not yet checked against reference tools
- Memory forensics with Volatility 3, which needs a signed driver for RAM capture
- An AI assistant that runs on a model you choose, such as Ollama, LM Studio, or any OpenAI-compatible service
Screenshots are coming once the current interface redesign lands.