Forensic disk images
Full-disk and partition images from the acquisition tools your lab already runs.
Home/Platform
The platform
Bloodhound ingests disk images, mobile extractions and logical collections, then parses, correlates and timelines the artifacts inside them so investigators can find what matters fast.
Read-only originals
Verified working copies
Every action ledgered
01 / Ingest
Ingest what you actually have
Bloodhound reads open and standard formats rather than locking your evidence behind a proprietary container. Originals are opened read-only and never modified, and all analysis runs against verified working copies.
Device extractions
Handset evidence from backup, filesystem and logical acquisition workflows, encrypted backups included.
Targeted collections
Scoped collections from consent searches, remote triage and enterprise DFIR work.
What happens at intake
- The item is registered with its acquisition metadata: who seized it, when, under what authority, and with which tool and version.
- A hash is computed over the source before any parser runs, and that hash becomes the item’s identity for the life of the case.
- A working copy is created and hash-matched against the original. A mismatch halts processing and is written to the ledger as an integrity event.
- Container structure is mapped before extraction begins: partitions, volumes, filesystems, encrypted regions.
- Each of these steps produces its own custody entry.
$ bloodhound ingest --case 2026-0441 \
--item "iPhone 14 Pro" ./EV-003.E01
✓ container EWF, 4 segments, 238.4 GiB
✓ mode READ-ONLY (write-blocked)
✓ sha256 9f2c41ab…d7e08b31
✓ working copy verified — hash match
✓ volumes 1 APFS container, 4 volumes
✓ ledger entry 0044 written & signed
EV-003 ready for analysis.
02 / Parse & recover
What the parsers pull out
File carving recovers files. What an examiner usually needs is the record inside the file: the single message, the deleted call, the location fix that puts a handset on a particular street at 02:14.
Messaging
SMS, MMS, RCS, iMessage and third-party app messaging, with threads, attachments, read state and participants intact.
Calls & contacts
Call logs with direction and duration, contact records, and the account identifiers that resolve several aliases back to one person.
Location
GPS fixes, cell and Wi-Fi derived positions, significant locations, geotagged media, app-level location caches.
Browser & network
History, downloads, cookies, cache, search terms and bookmarks across the major browsers.
Media & metadata
Images and video with EXIF, device attribution, capture times and edit history preserved.
App databases
SQLite, plist, protobuf, Realm and LevelDB stores parsed down to records, write-ahead logs and journals included.
Deleted record recovery
Freelist, WAL and journal recovery, plus unallocated and slack-space carving. Recovered records are labelled as recovered, never mixed in with live data.
System & usage
Account activity, installed applications, device configuration, power and connection events.
Every extracted record keeps its provenance: source item, file path, byte offset, and the version of the parser that produced it. When a finding is questioned two years later, that is what you go back to.
03 / Correlate
Correlating across devices
Unified supertimeline
Every parsed artifact contributes events to a single chronology covering every device in the case. Filesystem timestamps, message sends, location fixes, app launches, power events and network connections all land on the same axis, normalised to one timezone, with the source attributed on each row.
- Cross-device correlation, so you can see what the second handset was doing during the first one’s call
- Filter by artifact class, device, participant, keyword or time window
- Pivot from any event straight into the underlying record and its source offset
- Bookmark events directly into report findings as you work
TIME SRC EVENT
02:11:47 EV-003 location fix 44.6488,-63.5752
02:12:03 EV-003 app launch Signal
02:14:22 EV-003 message sent → +1902…4417
02:14:29 EV-007 message recv ← +1902…9930
02:15:10 EV-007 media created IMG_4482.HEIC
02:15:11 EV-007 exif geotag 44.6491,-63.5749
02:18:55 EV-003 call out 00:04:12
02:41:02 EV-003 message deleted (recovered)
03:02:18 EV-011 usb connect host WKSTN-04
2 devices within 38 m, 49 s apart
Link analysis
Resolve people, numbers, accounts and devices into entities, then map how they connect. Weighted edges carry frequency and direction, and the cluster view tends to be where the intermediary nobody saved as a contact turns up.
Geolocation mapping
Plot every position-bearing artifact on one map, reconstruct tracks, detect dwell locations, or scope a geofence around a time window to see which devices were inside it.
Hash-set matching
Import NSRL and agency hash sets to flag known material and suppress known-good system files. Fuzzy hashing catches near-duplicates that a byte-exact match misses.
04 / Review
The review workspace
Case dashboard
Case status, custody integrity, parser progress and key findings in a single view. Integrity anomalies surface here first, which is considerably better than surfacing in a courtroom.
Evidence explorer
Navigate filesystems at speed, with preview, metadata inspection, hex view, and a jump straight to the parsed records that came out of any given file.
Communications review
Threaded conversation view across channels and apps, with participant resolution and deleted records marked in sequence rather than listed separately.
Media review
Grid and detail review with duplicate collapsing, hash-set status, EXIF and device attribution, and category tagging for disclosure.
Case-wide search
Keyword lists, regular expressions and entity search across every parsed record and the raw file content, with provenance retained on each hit.
Bookmarks & findings
Flag an event, a record, a file or a map track into a structured findings list that feeds the report builder directly.
$ bloodhound report --case 2026-0441 --sign
✓ 1. Examiner & authority
✓ 2. Evidence inventory 12 items
✓ 3. Acquisition & hashes 12 verified
✓ 4. Methodology & tooling v2026.09.1
✓ 5. Findings 38 bookmarks
✓ 6. Exhibits 84 attachments
✓ 7. Custody appendix 117 entries
✓ 8. Validation statement attached
manifest: 84 files, 84 hash matches
output: 2026-0441-report.pdf [SIGNED]
05 / Report
Reports assembled from the case record
The evidence inventory, hash manifest, methodology statement and custody appendix are all generated from the case itself rather than retyped from it, which removes an entire category of transcription error from the most scrutinised document you produce.
- Findings with source attribution down to the byte offset
- Hash manifest covering every exhibit and attachment
- Complete custody appendix, chain-verified at export time
- Tool version and validation statement embedded in the record
- PDF and HTML, plus structured export for disclosure platforms
See it against your own evidence
Evaluations run on your hardware, with your reference images, inside your network.