Free Downloads

Sherlock Forensic Tools

Free forensic utilities built by investigators, for investigators. 20 years of courtroom-tested methodology in every tool.

Free forensic software from Sherlock Forensics: Android logical acquisition with chain of custody reporting, PST/OST email viewer with hash verification, file hash calculator (MD5, SHA1, SHA256, SHA512), metadata viewer/stripper for EXIF, PDF and Office documents. All tools produce SHA256 hashes for forensic integrity. Built by CISSP, ISSAP, ISSMP certified examiners in Vancouver.

Download

Desktop Forensic Tools

Available Now

Sherlock Forensics Disk Imager

Free forensic disk imager. Raw .dd and E01 output. Three-pass SHA-256 verification. Resumable imaging. Chain of custody manifest. FTK Imager alternative that resumes.

  • Raw .dd (single or segmented) + E01 output
  • Three-pass SHA-256 verification
  • Resumable imaging (survives crashes)
  • Chain of custody manifest
  • 4.4 MB single exe, no installer
Windows 10/11 v0.1.0 4.4 MB
SHA256: 7d4fe464d1778880cda66402630ee37832b08e0b808bb4d4665a891079aea7de
Available Now

Sherlock Forensics Android Acquirer

Android logical acquisition tool. Extract SMS, contacts, call logs, media, apps and more via ADB. Consent-gated helper APK. Court-ready forensic reports with per-artifact SHA-256 hashing. Forensic Edition from $399.

  • Logical acquisition via ADB
  • 9 data categories with toggle selection
  • Per-artifact SHA-256 hashing
  • Forensic PDF report generation (Pro)
  • Bootloader state detection
Windows 10/11 v0.1.6 5.0 MB
SHA256: b4ec8bd6a077a32090d4f35fc3cb32b9230c697b7ebe0b5f2057acaf966b0438
Forensic Edition — $399 USD
Available Now

Sherlock Forensics USB Write Blocker

Free forensic USB write blocker. Toggle Windows registry write protection for USB storage devices with one click. Prevents accidental writes to evidence drives during forensic imaging.

  • One-click write protection toggle
  • Registry-level USB write blocking
  • Device status monitoring
  • Forensic imaging workflow
  • 100% free, no license required
Windows 10/11 v0.1.6 3.9 MB
SHA256: 619a00ab8f0e446668fe7a25bd2d9eb795b3ba2e265116a56ad0b74a23a7980a
Available Now

Sherlock Forensics PST Viewer

Free PST and OST email archive viewer. Open, search and export emails without Outlook. Hash verification for forensic integrity. Forensic Edition from $67.

  • Open PST and OST files
  • Full-text search across all emails
  • Export individual emails or batches
  • Attachment extraction
  • Hash verification per message
Windows 10/11 v0.1.6 7.8 MB
SHA256: 14f14fb50fe2bf4c2a2b9232c8e06d37469a302fc79459ba11a9b88439497bc4
Forensic Edition — $67 USD
Available Now

Sherlock Forensics MSG/EML Viewer

Open Outlook .msg and RFC-822 .eml files without Microsoft Outlook. SMTP transport chain visualization, SPF/DKIM/DMARC authentication, anomaly detection. Forensic Edition from $67.

  • Open MSG and EML files
  • Folder mode with recursive scan
  • SMTP transport chain analysis
  • SPF/DKIM/DMARC authentication
  • Anomaly detection flags
  • MAPI timestamp comparison
Windows 10/11 v0.1.6 7.8 MB
SHA256: 14f14fb50fe2bf4c2a2b9232c8e06d37469a302fc79459ba11a9b88439497bc4
MSG Viewer EML Viewer
Available Now

Sherlock Forensics Browser Viewer

Extract history, bookmarks, downloads and extensions from Chrome, Edge, Firefox, Brave, Opera, Opera GX, Vivaldi and Tor. Auto-detects all profiles. Read-only forensic analysis. Forensic Edition from $29.

  • 8 browsers including Tor
  • Auto-detect all profiles
  • Works while browser is open
  • Read-only forensic analysis
  • CSV export (Forensic Edition)
Windows 10/11 v0.1.0 5.9 MB
SHA256: f49caa1f0d75da47c0d16b4f0b929fa18427c6bbe68bbc9309897ce5320a9c0d
Forensic Edition — $29 USD
Available Now

Sherlock Hash

Drag-and-drop file hash calculator. Compute MD5, SHA1, SHA256 and SHA512 hashes instantly. Compare against known values. Batch processing.

  • Drag-and-drop or browse
  • MD5, SHA1, SHA256, SHA512
  • Hash comparison mode
  • Batch file processing
  • Copy/export results
Windows 10/11 v0.1.4 3.9 MB
SHA256: dab4645cc86fe2ec6eb3ebb3472387e4bda26d14bb30defa4cab4220ff14a3b6
Available Now

Sherlock Forensics Meta

File metadata viewer and stripper. View, export and remove EXIF data from photos, metadata from PDFs and Office documents.

  • EXIF data from images (GPS, camera, dates)
  • PDF metadata and properties
  • Office document metadata
  • Strip metadata for privacy
  • Export metadata reports
Windows 10/11 v0.1.4 4.2 MB
SHA256: 3c50a0905ec3a9596176dba7a32baba68b2f493372d1d4f69c53fafd478c2726
Available Now

Sherlock Forensics Port Scanner

Fast network port scanner for security assessments. Scan TCP ports, detect open services and identify potential attack surfaces on your infrastructure.

  • TCP port scanning
  • Service detection
  • Common port presets
  • Export scan results
  • Lightweight and fast
Windows 10/11 v0.1.4 4.1 MB
SHA256: 0a7dee2ea06e90b4939f76a56462ddc6dbe81e1ed5c59a18c491f6bde12c726a
Available Now

Email Header Analyzer

Paste email headers, get visual hop trace, SPF/DKIM/DMARC authentication and spoofing detection. Runs in your browser.

  • Visual hop-by-hop timeline
  • SPF, DKIM, DMARC verification
  • Sender mismatch detection
  • Spoofing verdict
  • No installation required
Any browser Web tool
Launch Tool

Need More?

These tools handle collection. We handle investigation.

Free tools collect and verify data. Professional forensic analysis interprets it. Sherlock Forensics provides court-admissible investigations, expert witness testimony and incident response. 20 years of experience. See our complete roundup of the best free forensic tools for 2026. Read about our desktop tools launch.

Forensic Resources: Learn about our chain of custody methodology for evidence integrity and use our forensic report generator to produce structured documentation.

Since 20064.8/5 ratingCISSP, ISSAP, ISSMP certified
Start Investigation

Questions

About Forensic Tools

Are these tools free?
Yes. All tools are free for lawful forensic investigation, incident response and security research. No trial periods or feature restrictions.
Are these tools forensically sound?
Yes. Every tool produces SHA256 hashes, maintains operation logs and follows chain of custody principles. Built by the same team that produces court-admissible reports.
What systems are supported?
Desktop tools: Windows 10/11 (64-bit). Web tools: any modern browser on any OS.
How do I verify download integrity?
Every download includes a published SHA256 hash. Compare it against the hash of your downloaded file. If they match, the file is intact.
Can I use these in legal proceedings?
The tools produce forensically sound output with hash verification. For expert testimony support, contact Sherlock Forensics at 604.229.1994.

These tools are provided as-is for lawful forensic investigation purposes. Terms of Service

Download

Enter your details to download. We will send you update notifications for new versions.