Open-source disk forensics by Zero Science Lab. Website: zeroscience.github.io/kokino-ftk
One portable Rust binary with a browser GUI, on Windows, Linux and macOS.
Features | Screenshots | Install | Build | Forensic soundness | Security | Validation | Architecture | Roadmap | Changelog | Contact
Kokino Forensic Toolkit (Kokino FTK) is an open-source digital forensics workbench for disk images. Give it an E01, AFF4, raw, VHD, VHDX or VMDK image, a disc image, an AD1 or AFF4-L logical image or a triage collection (Velociraptor, KAPE, UAC, or a plain folder), and it reads every NTFS, FAT, exFAT, ext2/3/4, HFS+, APFS, ISO 9660 and UDF volume down to the last record, live and deleted, BitLocker volumes once unlocked and every Volume Shadow Copy included, brings back what was erased, and rebuilds what happened on the machine: Windows registry (deleted keys included), event logs, execution traces and scheduled tasks, Linux and macOS accounts, logons, shell histories and persistence, browser history (Internet Explorer's included, even from a formatted disk), email (Outlook PST and OST, Apple Mail, mbox), carved files and edited pictures, and what a case's evidence items have in common, on one case timeline and against a watchlist of known indicators.
Every finding links to the exact bytes it came from, every indicator of anti-forensic activity explains itself, and every examiner action lands in a hash-chained audit log, so the results hold up in a report and in court.
Status: 1.6.2 reads Ex01 (EnCase 7 and later) images with their stored hashes and acquisition details, joins PDFs with cross-reference streams and linearized PDFs split in two when carving, and imports HashKeeper and hashdeep hash sets. 1.6.1 brought AFF4 disk images, AFF4-L and AD1 logical images and deleted Outlook messages from the PST's free space; 1.6 plugin rows on the timelines and in the watchlist; 1.5 STIX and MISP watchlists, plugins, written CDs and DVDs and ESXi snapshots. Reads E01, Ex01, AFF4, raw and virtual disks, and NTFS, FAT, exFAT, ext2/3/4, HFS+, APFS, ISO 9660 and UDF; BitLocker, shadow copies, triage collections and logical images. Validated against NIST CFReDS, Digital Corpora, dfvfs and AFF4 reference images (VALIDATION.md); parsers fuzzed with 952 million inputs (SECURITY.md). See What's next.
- Cases and integrity: case store, evidence registration, single-pass MD5 / SHA-1 / SHA-256, verification against the acquisition hash, and a hash-chained audit log of every examiner action (
kokino verify-audit). - Images: E01 and Ex01 (EWF and EWF2, all segments, compressed or not), raw / dd, split raw (
.001,.002, ...), and virtual disks: VHD (fixed, dynamic, differencing), VHDX (dynamic, fixed, differencing) and VMDK (flat, sparse, streamOptimized, split, snapshots, ESXi VMFSSPARSE and SESPARSE snapshots), with parent disks found and checked automatically. For E01, Kokino checks the media against the hash the imaging tool stored in the image, shows the acquisition details it recorded (case, examiner, dates, device, tool) and flags sectors the imager could not read. AFF4 disk images (maps, snappy, LZ4 and deflate image streams, striped sets) with the case notes, device details and read errors they recorded. Ex01 (EWF version 2) the same way: its stored hash checked, its acquisition details shown. - Volumes: MBR (including extended partitions), GPT, unallocated gaps. Parses NTFS, FAT12/16/32, exFAT, ext2/3/4, ISO 9660, UDF, HFS+ and APFS. Volume Shadow Copies are rebuilt and read as volumes of their own. BitLocker volumes (Windows 7 and later, To Go) are listed with their protectors and unlocked with the password, the recovery password or the startup key file (.BEK); volumes with protection suspended are read without asking, and unlocked volumes are carved and searched decrypted. VHDX disks that were not shut down cleanly are read with their log replayed in memory.
- Images inside images and triage collections: disk images stored on the evidence (E01, AFF4, AD1, VHD, VHDX, VMDK, ISO, raw) are listed and can be extracted, verified and added as evidence of their own; Velociraptor and KAPE ZIP collections and UAC tar / tar.gz collections are read as file systems, and so are AccessData AD1 logical images (FTK Imager custom content images, any number of segments) and AFF4-L logical images, and so is a collection copied out as a plain folder (packed into the case with a manifest of every file's SHA-256), with artifacts found at the paths they had on the collected system.
- NTFS: every MFT record including deleted ones, $SI and $FN times at full 100 ns precision, alternate data streams, orphans, resident data, data-run offsets. Records that cannot be parsed are reported, never dropped silently. Names of deleted files whose MFT record was reused are recovered from folder index slack ($I30) and the NTFS log ($LogFile), with their times and size, and old names of renamed files with them. The change journal ($UsnJrnl) tells what happened to each file and when: created, written, renamed, deleted.
- FAT12/16/32 and exFAT: USB sticks, SD and camera cards. Live files follow the FAT chain; deleted files and folders are listed with their long names restored, their content read from the first cluster on, and a note when the clusters were reused or the first cluster no longer holds the file's header.
- ext2/3/4: Linux servers and desktops. Every inode, extents and block maps, directories with the names of deleted files recovered from directory slack, orphaned inodes, owner, mode, inode change and deletion times (ext4 to the nanosecond, with creation time). ext3 and ext4 clear a deleted file's block map; Kokino reads it back from an older copy of the inode kept in the journal when there is one, and says when there is not (then only carving can help). Older copies of folders in the journal give back the names of files deleted long ago, even when their inode now belongs to another file.
- Optical discs and .iso files: ISO 9660 with Rock Ridge (POSIX names, owners, modes, times, symbolic links, deep folders) and Joliet (Unicode names), multisession discs (the newest session is the live tree; files only older sessions list are shown as deleted, and their content is read from the disc), and UDF 1.02 to 2.60 (DVD, Blu-ray, packet writing; sparable partitions of DVD-RW and CD-RW through their sparing tables, virtual partitions of CD-R and DVD-R written incrementally through the VAT, with files removed in a later session listed from the earlier sessions' VATs) with directory entries marked deleted listed with what their file entry still holds.
- Mac disks (HFS+ and APFS): HFS+ and HFSX with hard links resolved, resource forks, extended attributes (including the quarantine flag set on downloads) and HFS compression decoded (zlib and LZVN; 7-Zip shows such files as empty). APFS containers with every unencrypted volume, object maps, hard links, symbolic links, extended attributes and compression. Deleted files are recovered from old catalog-node copies in the HFS+ journal, and from the older file-system tree nodes that APFS leaves behind when it writes changes to new blocks. Encrypted (FileVault) APFS volumes are reported.
- macOS system summary: macOS version, computer name and setup date, local accounts (dslocal), launchd persistence, downloads from the quarantine database, application use from KnowledgeC, FSEvents (the file system's change log, also on USB drives a Mac wrote to) and shell histories in /Users homes; from Mac disks and from collections.
- Linux system summary: accounts (passwd, shadow, group, lastlog; second root accounts, passwordless and system accounts with a shell flagged), logons, failures and reboots (wtmp, btmp, auth.log or secure, journald), shell histories (bash, zsh, fish and more, with times when recorded) with destructive commands flagged, sudo and account changes, installed packages and who installed them (dpkg, apt history, dnf/yum, apk, pacman), persistence (cron, systemd units, rc.local, SSH authorized keys, sudoers, ld.so.preload), USB storage seen by the kernel, Wi-Fi and other networks, DHCP leases and SSH known hosts. Classic syslog times are converted with the image's own time zone.
- Content: about 70 file signatures, extension mismatch, Shannon entropy, uniform-content (wipe) detection.
- Web activity: browser history from Chrome, Edge, Brave, Opera, Vivaldi, Firefox and Safari profiles: page visits (with how the page was reached and whether the address was typed), pages only the URL table still remembers, downloads with source URL, saved path and state, and search terms. Databases are read with their -wal file, so recent activity the browser had not yet merged is included. Internet Explorer 4 to 9 (index.dat): history (main, daily, weekly), cache, cookies and downloads, with deleted entries still inside the file and the clock's offset while browsing. Internet Explorer 10 and 11 and the old Edge (WebCache): history, cache, cookies and downloads. Deleted or cleared histories are flagged.
- Full-text search: an index over every file stream (live and deleted), every free cluster and the space outside partitions, with UTF-8 and UTF-16 text, plus the text inside documents: Word, Excel, PowerPoint, OpenDocument, ZIP archives (nested too), GZIP and PDF (page text with ToUnicode fonts, document info and XMP). Keyword, regex and preset searches (emails, URLs, IPs, Luhn-checked card numbers, IBANs, Bitcoin addresses); each hit links to the file and to its exact byte in the hex view. Searches are audit-logged.
- Windows system summary: registry (SYSTEM, SOFTWARE, SAM, NTUSER.DAT, UsrClass.dat, Amcache), event logs, Prefetch (including Windows 10/11 compressed files), LNK shortcuts, Jump Lists, scheduled tasks, the NTFS change journal and SRUM, deleted copies included: computer and accounts, USB devices with serials and connect times, networks, installed programs and autostart entries, scheduled tasks with when they were created and last ran (hidden ones flagged), programs run (Prefetch, UserAssist, BAM/DAM, Amcache, ShimCache, 4688), how much each program sent over which network and read and wrote to disk, hour by hour (SRUM, read with Kokino's own ESE database reader), files and folders opened, every folder a user browsed to in Explorer (ShellBags, including USB sticks, network shares and ZIP files long gone), every file created, renamed or deleted per the change journal, deleted registry keys and values recovered from the hives' free space (with the keys that record user activity named), and notable events in plain language (log clearing, logons, account and service creation, remote desktop, PowerShell).
- File carving: recovers files from free clusters, unpartitioned space and unparsed volumes by content, with format-aware end detection (JPEG, PNG, GIF, BMP, WebP, PDF, Office old and new, OpenDocument, ZIP, SQLite, executables, GZIP, 7-Zip, WAV, AVI, MP4, Jump Lists, event log chunks, Internet Explorer index.dat). JPEGs split in two or three pieces, PNGs, PDFs and ZIP-based files (Office, OpenDocument, JAR, APK, EPUB) in two are joined again, kept only when the joined picture decodes exactly or the CRCs and checksums check out. Internet Explorer history, cache and download records are recovered one by one from free space, as HstEx does. Picture gallery, hashes, audited export, and carved documents in the search index.
- Pictures (photo forensics): every JPEG, PNG and BMP (live, deleted, carved) checked for editing software, an EXIF thumbnail that no longer matches, double JPEG compression, camera EXIF with software compression tables, tables that differ from the same camera's other photos, data appended after the image, and LSB embedding in lossless pictures; each finding states what it does not prove, and the detectors are calibrated on real camera photos. A viewer with magnifier, error level, noise, level sweep, gradient, bit planes and copy-move (clone) detection, region bookmarks, and
kokino image <file>on the command line. - Email: messages in Outlook PST and OST files (any size, every folder, compressed OST 2013+), Apple Mail (.emlx), mbox mailboxes (Thunderbird, /var/mail) and .eml files, with text, headers and attachments (exported with an audit record), messages Thunderbird deleted but still holds, deleted Outlook messages recovered from unused entries of the PST's node index and from the file's free space, email on the timeline, and message text and document attachments in the full-text search.
- Exports: every list (files with hashes, timeline, web activity, Windows and Linux artifacts, indicators, carved files) as CSV or JSON, from the GUI or with
kokino export; each export is saved in the case and its SHA-256 recorded in the audit log. - Bookmarks and tags: bookmark files (hashed at bookmark time), events, carved files, search hits, browser history and byte ranges; tag and annotate them, filter by tag, and build a case report from them. Reviewers can tag too. All changes are audit-logged.
- Hash sets and hash analysis: import NIST NSRL (RDS v3 SQLite or SQL releases, or 2.x NSRLFile.txt), HashKeeper, hashdeep, CSV or plain hash lists as known good or known bad; MD5, SHA-1 and SHA-256 of every file, matched against the enabled sets. Hide known-good files and flag known-bad ones in the explorer, file details and reports.
- Byte map and strings: a binvis-style picture of a file, carved file or the whole image along a Hilbert curve, colored by byte class or entropy, where a click opens that offset in hex; and printable strings (ASCII, UTF-8, UTF-16LE) with offsets and filters.
- Case reports: a court-ready report of the bookmarked exhibits as HTML (print to PDF) and Word (.docx): every exhibit read from the evidence again and its hashes re-checked, pictures with marked regions, hex dumps, chain of custody from the audit log, methods, limitations and a sign-off block. Each report file's SHA-256 is recorded in the audit log.
- Timeline: MACB events from $SI and $FN (inodes on ext, with deletion times) interleaved with browser visits, downloads, searches, Windows or Linux system events and files created, renamed and deleted per the NTFS change journal, filterable by path, date, source, deleted and flagged.
- Anti-forensics likelihood: 26 transparent indicators (timestomping, SDelete patterns in the MFT and in the change journal, wiped content, disguised executables, ADS payloads, encrypted containers, a missing or recreated $UsnJrnl, event logs cleared (including Windows' own 1102/104 records), cleared browser history, wiping tools downloaded, researched or run, Linux shell histories cleared, logs emptied, shred and history -c typed, ld.so.preload rootkits, scheduled tasks hidden from the Task Scheduler, registry keys of user activity deleted, ...) combined with noisy-OR. See docs/ANTI-FORENSICS.md.
- Hex: a virtualized viewer for images of any size, a data inspector (ints, FILETIME, Unix time, UTF-16), text and hex search, and overlay editing: edits are stored in the case and audit-logged, and the evidence file is never written. You can export a byte range raw or with the overlay applied.
- Export and report: file and stream export (hashed and audited) and a self-contained HTML report.
- Updates: Kokino never contacts anything on its own. "Check for updates" on the About page (or
kokino version --check) asks GitHub for the latest release when you click it, shows its notes and checksums and links to the download; the check is recorded in the system audit log. - Built-in help: a searchable Wiki (getting started, roles, evidence, every view, browser history, hex, reports, LAN mode, command line, troubleshooting) and an About page with version and contact.
- Correlation: a case page listing what its evidence items have in common: users, computer names, email addresses, IP addresses, USB serials, wireless networks, web domains and identical files.
- Case timeline: every evidence item and volume of a case on one timeline, in time order, each row opening in its item.
- Plugins: parsers for artifacts Kokino does not read itself, as separate programs in any language: Kokino gives each a copy of every matching file and shows the JSON rows it prints. Off unless the server is started with
--plugins <folder>; every run is in the audit log with the SHA-256 of the plugin's files. See plugins/README.md and the example inplugins/internet-shortcut. - Watchlist: paste indicators (hashes, IP addresses and networks, domains and URLs, email addresses, file names and paths; defanged forms too) or load a STIX 2.1 bundle or MISP event export, and search every evidence item of the case at once; each sweep marks what is new since the previous one, and the list can be kept with the case.
- Cases and accounts: cases can be renamed, handed to another lead examiner, deleted and restored, all audit-logged. Every examiner signs in. Admins manage accounts and assign people to cases as examiner or reviewer (read-only). Every case action is attributed to the account in the audit log, and sign-ins are recorded in a hash-chained system audit log. Optional LAN mode serves HTTPS to a whole lab.
ROADMAP.md lists what is done and what comes next, in order, with what each item needs. Most of what is left waits for test data rather than code: disks from real Macs, APFS encryption and snapshots, LZFSE, Windows Search and XFS. Suggestions are welcome as GitHub issues.
 Cases |
 Evidence summary and anti-forensics score |
 File explorer (live and deleted) |
 Timeline |
 Windows system summary |
 Browser history |
 Full-text search |
 Carved files |
 Picture forensics |
 Hex viewer and byte map |
 Hash sets and hash analysis |
 Case report |
Download the package for your system from
Releases and check it
against SHA256SUMS.txt there. Each release also has a CycloneDX SBOM
(kokino-<version>-sbom.cdx.json) and a signed build provenance
attestation for every file (gh attestation verify <file> --repo zeroscience/Kokino).
| System | Package | Start |
|---|---|---|
| Windows 10/11 (x64) | kokino-<version>-windows-x64.msi (or .zip) |
Start menu: Kokino Forensic Toolkit |
| Linux (x86_64) | kokino_<version>_amd64.deb (Debian, Ubuntu, Kali) or .tar.gz |
kokino serve |
| macOS 12+ (Intel and Apple Silicon) | kokino-<version>-macos-universal.dmg |
Double-click "Start Kokino" |
Kokino starts a local server and opens your browser. The packages are not
code-signed yet: on Windows choose "More info", then "Run anyway"; on macOS
right-click "Start Kokino", choose Open, then Open again (the DMG's
"READ ME FIRST" explains). kokino purge removes everything Kokino stored on
the machine; uninstalling leaves your cases in place.
cargo build --release
./target/release/kokino serveserve binds to 127.0.0.1 and opens your browser. On first start it prints a
one-time setup link that creates the first admin account. Cases go to
~/KokinoCases (override with --cases).
For a lab server that examiners reach from their own machines:
./target/release/kokino serve --listen 0.0.0.0 --port 8443 --hostname forensics.labLAN mode always uses HTTPS. Pass --tls-cert and --tls-key for your own
certificate, or Kokino creates a self-signed one and prints its fingerprint.
Accounts can also be managed from the server console, which is the way back in if every admin is locked out:
./target/release/kokino user add jdoe --role examiner --display-name "Jane Doe"
./target/release/kokino user reset jdoe
./target/release/kokino user list
./target/release/kokino user delete jdoe # asks to type the name; used accounts keep a reserved usernameHeadless, using the same engine:
./target/release/kokino analyze disk.img --json analysis.json
./target/release/kokino analyze laptop.E01 --recovery-password - # unlock BitLocker (asks for the 48 digits)
./target/release/kokino hash disk.img # for E01 also verifies the stored MD5/SHA-1 (exit code 3 on mismatch)
./target/release/kokino artifact Security.evtx # one exported hive, .evtx, .pf, .lnk or Jump List as JSON
./target/release/kokino files disk.E01 --extract out/ # every file (live and deleted) with hashes; writes them out
./target/release/kokino carve disk.E01 # carved files with offset, length and hashes
./target/release/kokino verify-audit ~/KokinoCases/<case-id>- Evidence files are only ever opened read-only.
- Hex overlay edits live in
<case>/patches/and are applied only in the viewer and on explicit export. - Every action is logged to
<case>/audit.jsonlunder the examiner's account, with the SHA-256 of the previous entry. - Analysis is deterministic for a given image and Kokino version, and the version is stored with the results.
- Results are checked against public test images with ground truth, NIST CFReDS (61 deleted-file recovery images) and Digital Corpora: 99.8% of deleted-file blocks recovered correctly, image hashes matching the published values. See VALIDATION.md.
- Every parser that reads evidence is fuzzed (952 million inputs so far, 43 problems found and fixed) and
unsafeRust is forbidden in every crate. See SECURITY.md, which is also where to report a vulnerability. - The GUI needs a signed-in session (Argon2id passwords, HttpOnly SameSite=Strict cookies, login backoff), a CSRF header on every change and a known Host, which blocks other browser tabs and DNS rebinding. See docs/ARCHITECTURE.md.
python scripts/make_af_fixture.py # regenerate anti-forensics ground-truth fixtures
python scripts/make_e01_fixture.py # regenerate E01 fixtures from disk-af.img
python scripts/make_fat_fixture.py # regenerate FAT12/16/32 and exFAT fixtures
python scripts/make_ext_fixture.py # regenerate ext2/3/4 and the Linux server fixture
python scripts/make_photo_fixture.py # regenerate photo-forensics fixtures (Pillow, numpy)
python scripts/make_fuzz_seeds.py # regenerate fuzzer seed files
cargo test # includes replaying every input that ever broke a parser
cargo build --profile fuzz -p kokino-fuzz && ./target/fuzz/kokino-fuzz run all --secs 600 # fuzz the parsers (SECURITY.md)
python scripts/validate_cfreds.py target/validation/cfreds # NIST CFReDS check (VALIDATION.md)Layout: crates/kokino-core (cases, audit, hashing), kokino-image
(sources, volumes), kokino-ntfs (MFT walker), kokino-fat (FAT and
exFAT reader), kokino-analysis
(signatures, timeline, anti-forensics, carving, pictures, hash sets),
kokino-artifacts (registry, event logs, Prefetch, LNK, Jump Lists, browser
history), kokino-server (API + embedded ui/), kokino-cli (kokino
binary), kokino-fuzz (parser fuzzer). Packaging: packaging/ and
.github/workflows/release.yml.
- Website: https://www.zeroscience.mk
- Email: lab@zeroscience.mk (please report security issues here, privately)
- GitHub: https://github.com/zeroscience
The built-in Wiki (Help > Wiki) covers day-to-day use.
Copyright 2026 Zero Science Lab. Licensed under the Apache License, Version 2.0; see also NOTICE. Third-party dependencies are MIT, Apache-2.0 or similarly permissive and keep their own licenses (listed on the in-app About page).
The logo is a painting by Siebe Boersma (NL), which remains the artist's work and is not covered by the Apache License (see NOTICE).