DFIRoscope
Open source · Windows investigation

DFIRoscope

Open-source Windows investigation and cyber research tool

DFIRoscope Live is a practical Windows investigation and cyber research tool. Each release adds focused capabilities with verifiable downloads and complete source.

DFIRoscope Live

Releases

Explore the current release. Packages and past releases are on the Downloads page.

Latest release

DFIRoscope Live 0.4.0

Network, persistence, artifacts and AI investigations

Investigate recorded network activity, review persistence changes, examine Agent Prefetch results, and compare expected application information with captured evidence. Bring your own AI provider for evidence-linked chats and investigations.

  • Windows 64-bit portable packages
  • Unsigned public release
  • Source, provenance and SHA-256 inventory included
Release notes Source SHA-256 manifest
DownloadsGet the current release and browse past releases →
What is DFIRoscope?

An investigation workspace you can run.

DFIRoscope Live brings focused Windows investigation capabilities into an open-source desktop workspace. Earlier versions remain available for repeatable testing, while the current release provides the latest supported feature set.

DFIRoscope is not an EDR. It is not presented as a replacement for enterprise security products.

Release integrity

Verify before you run.

Verify downloaded packages against the published SHA-256 manifest and provenance before running them.

GitHub release
v0.4.0
Source tag
v0.4.0
SHA-256
Manifest
Binary signing
Unsigned public release