The open-source forensics toolkit that's both genuinely powerful and genuinely beautiful.
What remains tells the story.
Download · Documentation · Roadmap · Contributing · Security
Cinder is a unified, cross-platform digital forensics workstation that consolidates what currently requires eight separate tools — Autopsy, FTK Imager, the Eric Zimmerman suite, Volatility, Hindsight, ExifTool, Plaso, and WinHex — into one modern application with one UI, one case format, and one workflow.
Built for digital forensics examiners, incident responders, security students, and homelab tinkerers who deserve better than 1995-era UIs and five-figure price tags. Built natively in C# .NET 10 on Avalonia 11 so it looks and feels right on both Windows 11 and Linux.
Cinder is pre-alpha but actively useful. Most parsers and the core case workflow work end-to-end against real evidence today; a handful of heavy lifts (signed kernel drivers, Volatility memory pipeline, package managers) are still on the roadmap.
| Phase | Status | What's in it |
|---|---|---|
| 0 — Foundation | ✅ shipped | Avalonia shell, design system, command palette, SQLite case store, hash-chained custody log, Serilog, branding, CI |
| 1 — Hex viewer & hashing | ✅ shipped | Memory-mapped hex viewer (opens 100 GB images instantly), inspector, MD5/SHA-1/SHA-256/BLAKE3, 60+ signature scanner |
| 1.5 — Shell & UX | ✅ shipped | Home dashboard, per-tool help (F1), multi-case tabs, persistent recents, friendly empty states |
| 2 — Imaging & verification | ✅ shipped | In-process acquisition to raw / E01 / AFF4 / VHD / VHDX with hash-on-read and bad-sector fallback (E01 verified with libewf, AFF4 with pyaff4); read + verify for all of them; any→any conversion with re-read; mount works (VHD/VHDX/ISO). Signed write-blocker driver pending |
| 3 — Filesystem & carving | ✅ shipped | NTFS / FAT / ext2-4 / ISO9660 / VHD(X) via DiscUtils; $UsnJrnl and $LogFile parsers; header+footer carver with 30+ signatures |
| 4 — Windows artifacts | 🟡 shipped, unverified | Registry, EVTX, Prefetch, LNK, Jumplists, Shellbags, USB/Wi-Fi history, Amcache, ShimCache, SRUM, browser history, email — all parse, none yet diffed against a reference tool (why) |
| 5 — Linux artifacts | ✅ shipped | shell history, auth.log, syslog, cron, passwd/shadow, SSH known_hosts |
| 6 — Search, timeline, YARA | 🟡 partial | Lucene case-wide search ✅, YARA-lite ✅, Map ✅, Communication graph ✅; super-timeline merge pending |
| 7 — Memory forensics | ⬜ planned | Volatility 3 wrapper UI shell exists; RAM capture needs signed driver |
| 8 — Reporting & case mgmt | ✅ shipped | Real PDF (QuestPDF) + DOCX (OpenXml) reports, custody chain view, JSON workflows |
| 9 — AI copilot | 🟡 partial | BYOM provider selection (Ollama / LM Studio / OpenAI-compat) wired with health-check + DPAPI-encrypted keys |
| 10 — Network, mobile, cloud | 🟡 partial | PCAP ✅, iOS backup ✅, Android adb ✅, cloud OAuth/PKCE scaffolds (token exchange pending) |
Full status with line-by-line detail: ROADMAP.md. Known limits with workarounds: LIMITATIONS.md.
Not yet captured. The four shots below are the intended set; the capture
protocol (window size, theme, synthetic evidence to load, redaction rules) is in
docs/screenshots.md. Drop the files into
assets/screenshots/ with the names given there and uncomment the block below.
| Capability | Cinder | Autopsy | FTK Imager | EZ Tools | Volatility |
|---|---|---|---|---|---|
| Modern native cross-platform UI | ✅ Avalonia 11 | 🟡 Java Swing | 🟡 Win32 only | ❌ separate CLIs | ❌ CLI |
| Open source | ✅ Apache-2.0 | ✅ Apache-2.0 | ❌ freeware, closed | ✅ MIT | ✅ GPL-2 |
| Hex viewer (100 GB+ images) | ✅ memory-mapped + streaming find | 🟡 basic | 🟡 basic | ❌ | ❌ |
| Disk imaging (raw / E01 / AFF4 / VHD / VHDX) | ✅ in-process, libewf- and pyaff4-verified output | ✅ | ✅ E01 / raw / AFF4 | ❌ | ❌ |
NTFS journals ($UsnJrnl, $LogFile) |
✅ in-process, names recovered from slack | 🟡 USN via plugin | ❌ | ✅ MFTECmd / LogFileParser | ❌ |
| Filesystem parsers (NTFS/FAT/ext) | ✅ DiscUtils, in-process | ✅ via pytsk | ❌ | ❌ | ❌ |
| Windows artifact suite | 🟡 EZ libs in-process, unverified vs reference | ✅ ingest modules | ❌ | ✅ separate CLIs | ❌ |
| Email (.msg / .eml / .mbox) | ✅ | ✅ via plugin | ❌ | ❌ | ❌ |
| PCAP / PCAPNG | ✅ SharpPcap | 🟡 via plugin | ❌ | ❌ | ❌ |
| YARA scanning | ✅ YARA-lite | ✅ | ❌ | ❌ | ✅ |
| Full-text Lucene search | ✅ | ✅ | ❌ | ❌ | ❌ |
| Map (EXIF GPS auto-ingest) | ✅ | 🟡 | ❌ | ❌ | ❌ |
| Communication graph (email → DAG) | ✅ | ❌ | ❌ | ❌ | ❌ |
| Memory forensics | ⬜ planned | 🟡 plugin | ❌ | ❌ | ✅ canonical |
| PDF + DOCX reports | ✅ in-process | ✅ HTML/PDF | ❌ | ❌ | ❌ |
| Local AI copilot (BYOM) | ✅ Ollama / LM Studio / OpenAI | ❌ | ❌ | ❌ | ❌ |
| Workflow DAG runner | ✅ JSON DAG + handlers | 🟡 ingest modules | ❌ | ❌ | 🟡 plugins |
| Single unified case format | ✅ SQLite + tamper-evident custody log | ✅ | ❌ | ❌ | ❌ |
| Telemetry | ✅ never | ✅ never | ✅ never | ✅ never | ✅ never |
| Price | Free, forever | Free, forever | Free download, closed | Free | Free |
✅ ships and works · 🟡 partial / shell-only · ❌ not provided · ⬜ planned
Where Cinder distinguishes itself: one app instead of eight, modern cross-platform native UI, everything in-process (no Python venv churn for the common Windows-artifact cases), and a BYOM AI copilot that nobody else in the space ships.
Where the established tools win today: Autopsy has a decade-plus of courtroom history and deeper ingest-module ecosystem; Volatility is the canonical memory tool and remains the source of truth until Cinder's Phase 7 lands; FTK Imager is still the friendliest single-purpose acquisition tool on Windows.
Download the self-contained build for your platform from the latest GitHub Release — no dependencies to install, no Python venv to manage, the runtime is bundled.
Windows — Cinder.exe, single-file self-contained .NET 10. Double-click
to launch. Right-click → Run as administrator if you need raw-device access.
Linux — cinder-linux-x64.tar.gz. Extract and run:
tar xzf cinder-linux-x64.tar.gz
./CinderVerify the download against SHA256SUMS.txt from the release page:
sha256sum -c SHA256SUMS.txtWindows releases are currently unsigned. Cinder has an active
application with the SignPath Foundation's free
code-signing program for open-source projects; the release workflow at
.github/workflows/release.yml is already
wired to submit signing requests via signpath/github-action-submit-signing-request
the moment approval lands — see .signpath/ for the artifact
configuration and signing policies.
Until the certificate is issued you will see one of two things on Windows:
- SmartScreen — a blue "Windows protected your PC" panel on first
launch of
Cinder.exe. Click More info → Run anyway. - A yellow badge in your browser's download bar — the browser (Edge / Chrome / Firefox) doesn't yet recognise the SHA-256 of the exe. Choose Keep (Chrome / Edge) or the equivalent in Firefox.
Neither of these means the file is malicious. They mean the file is new to Microsoft's reputation service and unsigned — the same state as every open-source Windows binary before it accumulates enough downloads or gets code-signed.
How to verify a release manually (Windows PowerShell):
# 1. Download Cinder.exe + SHA256SUMS.txt from the release page
$expected = (Get-Content .\SHA256SUMS.txt | Select-String Cinder.exe).ToString().Split()[0].ToLower()
$actual = (Get-FileHash .\Cinder.exe -Algorithm SHA256).Hash.ToLower()
if ($expected -eq $actual) { "OK" } else { "MISMATCH — do not run" }Or on Linux / WSL:
sha256sum -c SHA256SUMS.txt --ignore-missingThe SHA256SUMS.txt in every release is generated inside GitHub Actions
from the exact bytes that will be published as the release asset — so a
match against your download proves the binary hasn't been tampered with
in transit. Reproducible-build provenance follows once SignPath is live.
Package-manager installs are tracked but not yet shipping:
winget install AffluentLabs.Cinder · yay -S cinder (AUR) ·
.deb for Debian/Ubuntu · .rpm for Fedora/RHEL · AppImage for any
distro. The manifests live in packaging/ — they'll go
live on the next release cycle once SignPath signs the Windows exe.
- Launch Cinder and click New case from the home dashboard. Pick a name and a directory; Cinder creates a SQLite-backed case store with a hash-chained chain-of-custody log inside it.
- Open evidence — drop a disk image (
.E01,.aff4,.dd,.raw,.vhd,.vhdx), a registry hive (NTUSER.DAT,SYSTEM), an event log (.evtx), a PCAP, a.msg/.eml/.mbox, or basically anything. Cinder's signature scanner auto-routes the file to the right tool. - Browse with the Hex viewer (Ctrl+O) and the Inspector to read bytes, decode integers / floats / GUIDs / FILETIME at the caret.
- Build a Lucene index of the whole case folder (Search tool → "Build index from folder…") and full-text search across every parsed artifact.
- Export a report (Reports tool) as PDF or DOCX with cover metadata, per-section narrative, embedded exhibit cards, and a full exhibit index — no external converters.
Press F1 on any tool for a "what it is, when to use it, how" written explainer. Press Ctrl+K anywhere to open the command palette.
Prerequisites: .NET 10 SDK and Git. Python 3.12 is only needed for the optional Volatility 3 and RAM-capture sidecars. Full setup in CONTRIBUTING.md.
git clone https://github.com/AffluentMods/cinder.git
cd cinder
dotnet build
dotnet run --project src/Cinder.AppTests:
dotnet testForensic tools need raw disk access.
- Windows — launch with Administrator privileges, or use a hardware write-blocker.
- Linux — either
sudo cinder, or grant the capabilities once with:sudo setcap cap_sys_rawio,cap_sys_admin+ep $(which Cinder)
┌─────────────────────────────────────────────────────────────────────┐
│ Avalonia UI 11 (cross-platform shell) │
│ MVVM via CommunityToolkit · ReactiveUI · FluentAvalonia │
└──────────────────┬──────────────────────────────────┬───────────────┘
│ │
┌───────────────▼─────────────┐ ┌───────────────▼──────────────┐
│ Cinder.Core (.NET 10) │ │ Cinder.AI / Search / │
│ case store · custody log · │ │ Reports / Workflow / Hex / │
│ hash service · signatures │ │ Carving / Imaging / Plugins │
└──────┬─────────┬────────────┘ └──────────────────────────────┘
│ │
┌──────▼─────┐ ┌─▼─────────────────┐ ┌─────────────────────────┐
│ SQLite │ │ Cinder.Native │ │ Python 3.12 sidecars │
│ case DB │ │ ↓ Windows / Linux │ ←→ │ pytsk3, libpff, vol3, │
└────────────┘ │ platform code │ │ the long-tail formats │
└───────────────────┘ └─────────────────────────┘
Detail in docs/plan.md §2 (Architecture).
When defense counsel can audit the tool that produced your evidence, methodology challenges are easier to defeat. Open-source forensic tools (The Sleuth Kit, Volatility, Plaso) hold their ground in courtrooms against five-figure commercial alternatives for exactly this reason. Cinder follows that posture: every parser is reviewable, every algorithm is auditable, every report is reproducible from the case bundle.
Cinder reads attacker-controlled bytes by definition. The threat model, the v0.1.0 hardening pass (command injection, decompression bombs, plugin trust gates, key zeroization), and the responsible-disclosure process all live in SECURITY.md. Report vulnerabilities privately via GitHub Security Advisories — never as a public issue.
None. Cinder does not phone home. Ever. No analytics, no crash reporting that uploads to a server, no usage pings beyond a public GitHub API call (for update checks) that you can disable. Your evidence stays on your machine.
Contributions are welcomed and encouraged — every parser, every artifact,
every UI polish helps. Read CONTRIBUTING.md for the
dev setup, coding conventions, and PR workflow. Issues tagged
good first issue
are intentionally scoped for newcomers.
This project adheres to the Contributor Covenant 2.1 Code of Conduct. Be excellent to each other.
Cinder is free and will stay free. If it saves you time, sponsor on GitHub or contribute a parser. Funds go toward code-signing certificates, test hardware, and domain renewals — not salaries.
Apache License 2.0 — use it commercially, fork it, embed it, modify it. Just keep the copyright notice and don't sue us over patents.
Cinder stands on the shoulders of giants in the digital-forensics community, both open-source projects and individuals:
- The Sleuth Kit and Brian Carrier
- Autopsy and Basis Technology
- Volatility Framework and the Volatility Foundation
- Eric Zimmerman's tools —
Registry,evtx,Lnk,Prefetch,JumpList - Plaso / log2timeline
- DiscUtils,
PdfPig,
QuestPDF,
SharpPcap,
MetadataExtractor,
MsgReader,
Lucene.NET, and every other library
listed in
Directory.Packages.props - Avalonia UI and the Avalonia community
Built by Affluent Labs.