Anti-ForensicsRendering Digital Investigations Irrelevant
Reference Library · Read • Investigate • Corroborate

Projects

Find verified original source repositories and distinguish source inspection from tool validation.

Materially reviewed · Curated reference

Original code with a defined use case

A public repository makes source available for inspection. It does not by itself establish correctness, maintenance guarantees, or suitability for evidence. Record the exact commit and environment if code contributes to an examination.

get_notepad

The Anti-Forensics/get_notepad repository describes exporting Notepad tab-cache data to JSON. Pair source review with the existing Notepad tab-cache article and a controlled sample from the same application build.

Verification: repository existence and description checked 22 October 2026; binary behavior and platform compatibility not tested in this release. The organization API did not identify a license. Confirm reuse permission in the repository before redistribution. No binary is hosted here.

Analysis projects maintained upstream

The tool directory records capabilities, platforms, limitations, license checks, and upstream maintenance observations. This page links to original projects rather than repackaging their releases.

Review a project as part of the method

A project page should help a reviewer identify the code that contributed to a finding. Record the repository, exact commit or release, relevant component, dependencies, configuration and input. Keep the source version separate from the version of the application that produced the evidence. Both can matter when a cache or export format changes.

For the Notepad extraction project above, a useful study would preserve a controlled application session, its collected cache, and the JSON produced by a recorded source revision. Compare the output with independently established session contents. Check an unavailable or unsupported input as well as a successful example. This is a proposed validation design; no such experiment was performed for this release.

Four different project checks

  1. Identity: establish which upstream repository or vendor distribution actually produced the component.
  2. Permission: read the applicable source, dependency and dataset licenses before sharing a bundle. An unresolved license field remains unresolved.
  3. Applicability: check the input format, producer build, environment and specific feature relied upon.
  4. Behavior: test the bounded claim with known inputs and retain disagreements, errors and unsupported conditions.

An active repository can still contain an unsuitable feature for a particular examination. Conversely, a historical project can remain useful for interpreting an older dataset when its context and limitations are explicit. A push date is an observation about repository activity, not a maintenance or correctness guarantee.

Connect upstream code to an evidence question