STRATA
Digital forensics suite

Every byte,
accounted for.

Strata is a digital forensics suite: it opens forensic images, reconstructs the volumes and filesystems underneath, and parses the artefacts scattered across them — registry, browser history, mail, documents and more. Cross-platform, offline, and built on nothing but the Python standard library. Evidence stays read-only; every action taken is written to a tamper-evident audit log.

View on GitHub ↗See what it reads
0 pip installs
0 network calls
MIT licensed
6filesystem families — NTFS, FAT/exFAT, ext2/3/4, APFS, HFS+
10image & container formats — EWF, raw/dd, VMDK, VHDX, VHD, VDI, QCOW2, DMG, AFF4, AD1
17artefact parsers — registry to the NTFS log
29carving signatures, self-describing lengths where the format has one
Why Strata

Built to be trusted with evidence.

Every layer is parsed the way the format actually specifies it, not the way most evidence happens to look — which is where the interesting detail tends to hide.

No dependencies

The Python standard library, and nothing else. No pip install, no build step, no network connection — the application never touches the network, and that's enforced rather than assumed.

The core sample

A strip beside the hex view maps whatever's in scope by classifying every region — zeroed, text, structured, dense, high entropy — so the shape of an image is visible before anything has been opened. It doubles as the scrollbar.

Cross-platform

Windows, macOS and Linux, including ARM. One codebase, one interface — evidence is examined the same way regardless of what it's opened on.

Chain of custody

Every action an examiner takes is written to an append-only, hash-chained audit log. Altering any entry breaks every link after it, and the interface reports where — including entries cut from the end.

Everything it reads

Containers & volumes

EWF (E01/L01 and EnCase 7 Ex01), raw/dd, VMDK, VHDX, VHD, VDI, QCOW2, DMG, AFF4 and AD1 — plus RAID 0/1/5 sets assembled from their member images, and a folder, zip or single file opened as a logical exhibit. MBR (including extended partitions) and GPT volume layout, with acquisition hashes recovered and re-verifiable.

Filesystems

NTFS, FAT12/16/32, exFAT, ext2/3/4, APFS and HFS+/HFSX — parsed directly, with deleted entries, file slack and unallocated space reachable throughout. Volume Shadow Copies and APFS snapshots open as browsable views of the volume as it was. Transparently compressed files (zlib, LZVN and LZFSE) and hard links are read on HFS+ and APFS.

Encryption

BitLocker — including Vista/7 volumes using the Elephant diffuser — LUKS1 and LUKS2 (Argon2id/i/d and PBKDF2) unlock with a password or recovery key. The key is held for the session only, never written into the case.

Artefacts & analysis

Seventeen parsers — registry, change journal, the NTFS log ($LogFile), prefetch, shortcuts & Jump Lists, Recycle Bin, shellbags, Amcache/ShimCache, browser history and cache, event logs, timeline, hashing and more. Every event log on a volume merges into one described timeline, with unified search across content and raw media and a per-path diff between any two volumes or snapshots.

Documents & media

SQLite, ESE/EDB and LevelDB stores, PST (Unicode and ANSI), OST and mbox mail, Office files including legacy .doc, .xls and .ppt, OpenDocument, PDF, photograph EXIF and GPS, and cryptocurrency wallet material — each checksum-verified.

Cases

Several exhibits and several examiners in one case, with notes attributed to whoever wrote them and every edit kept. Extraction with per-item hashes and a manifest, a self-contained HTML report, and the audit log behind all of it.

The interface

Structure, bytes, inspector.

A canvas hex view built to scale, a data interpreter reading both byte orders at once, a split view for comparing two offsets, previews that never execute what they show, and a template editor for turning any on-disk structure into named, offset-mapped fields without writing code.

The Strata interface showing an evidence tree, a directory listing, the hex view with the core sample strip, and the inspector — dark theme on the left half, light theme on the right.
Both themes, one frame — dark on the left, light on the right. Six themes ship in total, including two high-contrast.
Core sample

Follows the selection — map a whole image, a single volume, or one file end to end at full resolution.

Split view

Two independent cursors over the same scope, both reading through identical code — a boot sector against its backup, a record against its mirror.

Safe previews

Images, text and documents render. HTML, SVG and scripts never execute — active content is stripped first, and what was removed is listed.

Command palette

Marks, tags, saved searches and keyboard shortcuts throughout, plus six themes including two high-contrast.

Status

An initial release.

Strata does what's described here, but it's early — expect rough edges, and expect some of it to change. Testing is ongoing rather than finished, and none of it has been independently validated. Corroborate anything that matters against another tool before you rely on it.

v0.9.0MIT licence"Strata" is not licensed with the source
Run it

No install. No network. No account.

Evidence is opened read-only, and it stays that way — there is no write path to an image anywhere in the engine.

shellpython 3.8+
# then open http://127.0.0.1:8722
python3 run.py

# start with evidence loaded, examiner recorded
python3 run.py image.E01 --examiner "A. Examiner"

# open a browser automatically once it's up
python3 run.py --browser

# refuse export and report writing for this run
python3 run.py --read-only
stdlib onlyno pip installno build stepzero network calls

An optional native module, downloaded separately with each release, speeds up encrypted-volume unlocking, registry log validation and fuzzy hashing. Without it Strata runs exactly as above, just slower for those things.