File System Recovery Tool

A Windows forensic application built for law enforcement and digital examiners who work with storage media — from USB drives to chips pulled off circuit boards.

The basics: Forensic USB imaging, triple write protection, partition detection, deleted file recovery, PhotoRec carving with 480+ signatures, drone telemetry parsing, EXIF extraction, hash verification, and evidence export to CSV and KML.

The specialized stuff: Three integrated modules for hardware-level forensics. NAT analyzes raw NAND flash dumps — OOB stripping, bad block handling, filesystem extraction (SquashFS, JFFS2, YAFFS2, ext), with drone presets built in. SAT handles SPI NOR flash — auto-detects ARM firmware vs FPGA bitstreams, classifies extracted strings, scans for embedded GPS coordinates, and generates forensic reports (PDF, XLSX, KML). GPS Tool connects to u-blox receivers over serial for forensic-grade log download, live capture, and onboard flash management — with chain-of-custody tracking and integrity hashing.

​

FSR Tool is for lawful forensic examination, authorized research, and education only. You're responsible for having proper legal authority before imaging or analyzing anything. This tool doesn't bypass encryption or circumvent access controls — it analyzes data you already have lawful access to. Provided "as is" with no warranty. Evidence handling and courtroom admissibility are on you and your training, not us.

​

# FSR Tool — Changelog

​

## v6.0.1 — September 2026

### New Features

- **Multi-device evidence tree** — Add multiple forensic images to one case. Each device appears as a top-level node in the evidence tree (FTK Imager style). Browse → Scan additional images to stack them in the tree.
- **FFmpeg Media Tool** — Video/image/audio analysis and repair using bundled ffmpeg.exe. 28 operations including container repair, error detection, force decode, deinterlace, frame extraction, contact sheet, and custom commands. Accessed via "Open in FFmpeg" in the file viewer.
- **Forensic Utilities** — Toolbar button with three tabs: DCode-style timestamp converter (9 formats), Base64/Hex/URL/ROT13 encoder-decoder, and DVR/CCTV time offset calculator (time difference, corrected time, footage time, retention period).
- **Case Report Generator** — One-click PDF report from the case banner. Includes case info, devices, partitions, file listings, hash verification results, tagged evidence, and SHA-256 integrity hash embedded in the report.
- **Evidence Tagging** — Right-click any file in the evidence browser or search results to tag it (Key Evidence, Suspicious, Flagged for Review, Exculpatory, Contraband, etc.). Tags appear in the case report.
- **View in Maps (GPS)** — Right-click an image in the evidence browser or select one in search results to extract GPS coordinates from EXIF. Opens Google Maps if online, shows coordinates with Copy if offline.
- **Screen Grab** — Purple button in the browser status bar opens Windows Snipping Tool for capturing screenshots during analysis.
- **File Signature Detection** — Properties tab shows magic bytes identification (JPEG, PNG, PDF, ZIP, PE, etc.) when a file is selected.

### Bug Fixes

- **Multi-monitor window positioning** — NAND, GPS, SPI, Drone, and activity log windows now open on the same monitor as FSR instead of off-screen.
- **E01 hashing after acquisition** — Rewrote to single-pass MD5+SHA-1 with direct pyewf access. Errors now surface in the activity log instead of failing silently.
- **Installer ghost entries** — Uninstall now removes files, shortcuts, AND registry entry. Legacy entries from old versions cleaned up automatically on reinstall.
- **Installer UAC enforcement** — Refuses to proceed without admin rights, preventing VirtualStore redirection.
- **Installer version** — Updated from 5.5 to 6.0.1.
- **DAT browse dialog** — Single native Browse button with All Files default. Drag-drop expanded to all flight log extensions.
- **Bare except clauses** — Replaced with proper exception types.
- **self.parent() → self.parent_app** — Fixed fragile Qt parent reference in USB imaging completion handler.

### UI Changes

- **Toolbar** — DAT renamed to "Drone". New buttons: Utilities, DVR (inside Utilities).
- **Evidence tree emojis** — Restored disk/partition/folder icons for professional appearance.
- **QDialog windows** — FFmpeg and Utilities dialogs now have minimize/maximize/close buttons.
- **Help dialog** — New tabs: FFmpeg (usage guide with operations table), Utilities (timestamp formats, encoder/decoder, DVR calculator).