DFIRoscope
DFIRoscope Live

Downloads

Download the current release or revisit an earlier build. Verify packages with the published SHA-256 manifests.

Latest release

DFIRoscope Live 0.4.0

Network, persistence, artifacts and AI investigations

Investigate recorded network activity, review persistence changes, examine Agent Prefetch results, and compare expected application information with captured evidence. Bring your own AI provider for evidence-linked chats and investigations.

  • Windows 64-bit portable packages
  • Unsigned public release
  • Source, provenance and SHA-256 inventory included
Release notes Source SHA-256 manifest
Self-contained 114.1 MiB · Windows x64 Includes the .NET runtime Framework-dependent 72.4 MiB · Windows x64 Requires .NET 10 Desktop Runtime
Release archive

Past releases

Looking for 0.3.0? View its release and downloads ↗

Published releases · oldest to newest
Release Investigation scope Resources Downloads
EDU Release 1 0.1.0-edu.s1e1
Processes and agent capture

Agent-based capture, process listing and selected-process details.

edu-2026.08-s1e1 		EDU.1.1 · Installation and Windows Process Analysis YouTube ↗
Release notes Source
Self-contained 111.1 MiB · Windows x64 Framework-dependent 69.5 MiB · .NET 10 required SHA-256 manifest ↗
EDU Release 2 0.1.0-edu.2
Latest 		Windows Security monitoring

Collect Windows Security Events and investigate events associated with processes, alongside agent capture and process details.

edu2 		EDU.2.1 · Windows Security Monitoring: Practical Theory YouTube ↗ EDU.2.2 · Investigating Windows Security Events YouTube ↗
Release notes Source
Self-contained 111.6 MiB · Windows x64 Framework-dependent 69.9 MiB · .NET 10 Desktop Runtime required SHA-256 manifest ↗