FSR — Forensic Seizure and Recovery Tool

From seized device to signed-off report, in one workbench.

Drones, SD cards, USB drives and bare flash chips land on an examiner’s desk every day. Each one usually needs a different tool, and every step needs a hash, a log entry and a line in the report. FSR puts the whole job in one place. Image the device, explore what’s on it, decode the flight logs, put every place and time on a map, and produce a court-ready report. Every step is recorded in the case as you go.

FSR is built for law enforcement and forensic examiners. It runs entirely on your own workstation, works fully offline, and is free.

Why examiners choose FSR

• One tool, start to finish. Imaging, analysis, drone logs, flash chips, databases and reporting all live in one case.

• Evidence integrity at every step. MD5, SHA-1 and SHA-256 are recorded on acquisition, verified on demand, and kept for every recovered file, export and report.

• Times exactly as stored. File times are shown as the device recorded them and labelled UTC or device-local. They are never silently converted.

• Nothing leaves your PC without asking. Maps and lookups work offline. Online maps and links are off until you choose them, and each use is logged.

• A case record that speaks for itself. An activity log, Verify Case, a one-zip Archive Case and a PDF report sealed with its own SHA-256.

What FSR does

Acquire

• Image USB drives and SD cards to E01 or raw, with software write-blocking and hashes verified on completion

• Verify any image against its recorded hashes at any time

• Convert raw images to E01, and handle disks with 4K sectors

Explore the evidence

• Open several images at once: partitions, folders, live and deleted files, with all four file times

• Real file types: see what every file really is from its content, with renamed files flagged in red (a flight log saved as notes.txt, a photo disguised as a .dll)

• Search by name, extension or real type, across one image or all of them

• Tag evidence, recover files (each one hashed automatically), and view files in hex or open them in a viewer

• Sleuth Kit tools one right-click away (istat, fsstat, timelines, unallocated space and more), with each exact command recorded

• File carving with PhotoRec or custom signatures

Drones

• Find every flight log on an image, including renamed ones

• Decode DJI .DAT logs, including encrypted logs from the DJI Avata, O3 Air Unit and Goggles 2, plus ArduPilot, PX4, Betaflight, MAVLink and Autel logs

• Flight tracks to KML and CSV, with a clear flight report: aircraft, home point, key events and airspace

• Impossible positions are kept off the map and listed with the reason; the decoded data keeps every value

• A Drone Dossier for each aircraft: serials, batteries, flights, home points, and where each log came from

See the whole case

• Case Overview: everything with a place and a time (flights, photos, videos, GPS tracks) on one map and one timeline, with flight replay

• A built-in offline world map, your own map packages, or an optional online street map

• Device clock comparison: suggested corrections for cameras and SD cards, worked out from matching evidence

• Triage: flight logs, drone media, app databases, photos, videos, deleted files and disguised files, sorted into cards at a glance

Specialist analysis

• NAND flash (chip-off): bad blocks, YAFFS2, JFFS2, SquashFS and ext extraction from raw NAND dumps

• SPI flash: firmware structure, strings, coordinates and bitstreams from SPI NOR dumps

• GPS devices: live acquisition from GPS receivers with a chain-of-custody report

• SQLite Browser: browse app databases, recover deleted records, and decode dates, with write-ahead logs handled

• Hash sets: check every file against your known-file lists and flag the matches

Report and close the case

• A PDF case report with cover, summary, integrity verdict, maps, dossier, triage, tagged evidence and file listings, with its SHA-256 recorded

• Verify Case re-checks every recorded hash

• Archive Case puts the entire case in one verified zip, with a manifest of every file and its hash

Requirements

Windows 10 or 11 (64-bit). Install it and run it; nothing else is needed.

FSR — Forensic Seizure and Recovery Tool. Free for forensic examiners. Built by DH Teams Inc.