**FSR — Forensic Seizure and Recovery Tool**

 

---

 

## v7.0.0 — October 2026

 

The first release under the FSR name: a forensic workbench for seized storage and devices (drones, SD cards, USB drives, flash chips), from imaging to the case report, with every step recorded in the case.

 

### Main window

- Dark header with the FSR icon, the **case chip** (case details and the case menu) and an always-visible **write-block pill** (green ON, red OFF; click to switch).

- **Toolbar in the order of the work:** Evidence, Analyse, Specialist, Review (Triage, Drone Dossier, Overview) and Case (Tags, Carves, Report, Archive Case, Open Folder). Only the next step is blue.

- **Evidence sidebar:** each image with its format, size and hash status (Hashes verified, Hashes recorded, Not verified, Hash MISMATCH). Click "Not verified" to verify it now.

- **Start page:** write-block warning, the three steps (Case, Evidence, Analyse), recent cases and workstation checks; an image summary before it is scanned.

- **Windows fit the screen** they open on, at any Windows display scaling; content that cannot fit scrolls.

- Help with search, grouped pages and a page for every tool.

 

### Imaging and verification

- **USB imaging** to DD (FSR's own engine) or E01 (ewfacquire), with software write-blocking, MD5 / SHA-1 / SHA-256 taken while reading, the device's details, and one imaging report per image.

- Lists devices with no drive letter (damaged, unformatted or Linux cards) and flags UASP devices, which ignore the software write-block.

- **Verify Hash** for DD and E01, against the case device or the imaging report, saved to the case.

- **Archive Case:** Verify Case first, a case report if there is none, then the whole case in one verified zip (raw images - DD, BIN, RAW, IMG and split .001 sets - compressed to E01, every file in a SHA-256 manifest). **Convert to E01** for one image.

 

### Case management

- Case folders, evidence devices with their hashes, evidence tags, carves, an activity log and session resume (every open image reopens).

- **Tamper-evident activity log:** each line is chained by SHA-256 to the one before, so a changed, removed or inserted line is detected.

- **Verify Case:** re-hashes everything the case recorded (the log chain, reports, recovered and carved files, Sleuth Kit outputs, map packages, optionally the images) and reports OK, CHANGED or MISSING for each.

- **Case report (PDF):** tick what goes in it (or pick Everything, Tagged evidence, Drone report, Overview and Triage); cover, Summary at a Glance, integrity verdict, Triage, the Case Overview map and flights, the Drone Dossier, the last Verify Case and Page N of M, with a progress window while it is made. Full-width tables, every hash in full on its own line, paths that copy out exactly. Its SHA-256 is saved beside it and in the case.

 

### Evidence browser

- Partitions, files and deleted files, with Created, Modified, Entry Modified and Accessed **times exactly as stored** (UTC or device local, labelled).

- Several images open at once; click one (or anything under it) and Carve, Verify Hash and Search act on it.

- Tag, recover (every recovered file hashed), hex view, File metadata and Convert Times on the right-click menu; right-click to collapse an image's partitions.

- **Carved files under each image:** every carve's files by type, with preview, open, tag and SHA-256; the sidebar shows each image's carved count.

- **Sleuth Kit programs** from the right-click menu (istat, fsstat, timeline, unallocated space, mmls, img_stat and more), with the command, output and SHA-256 recorded in the case.

- Double-click to open a file in the FFmpeg Media Tool or the program Windows uses for it.

- **4K-sector disks:** images of disks with 4096-byte sectors (raw or E01, GPT or MBR) open at the right partition offsets.

 

### Case Overview, Triage and Drone Dossier

- **Map:** everything in the case with a place and a time (drone flights, photos and videos with GPS, SRT paths, GPS tracks), on an offline world map or an optional map package of the case area. **Replay** a flight with photo pins appearing as they were taken.

- **Timeline:** one row per device and source (flights, photos, file times, database dates, GPS), with filters, search, zoom and Save to CSV.

- **Device clocks:** everything shown in UTC; a suggested correction for local clocks (cameras, SRT, FAT / exFAT) from matching photo positions to a flight or track. Stored times are never changed.

- **Triage:** the open images and the case's carved files sorted into cards: flight logs, drone media, app databases, photos, videos, audio, documents, archives, deleted and carved files.

- **Drone Dossier:** one page per aircraft: model, serials, batteries, flights, time in the air and where each log came from.

- Drone positions recorded before a GPS fix, far from the real flight, are left off the map and noted.

 

### SQLite Browser

- Opens databases straight from the evidence; works on hashed copies, never the original; read-only.

- Schema overview, tables, filters, read-only SQL, BLOB viewer, database versions (WAL commits, journal) and the History of changed rows.

- **Dates:** finds date columns and converts a whole column in one click; any value opens in the Time Converter.

- **Reports without SQL:** report builder, How do I...?, I want... in plain words, ready-made layouts for Android, iOS, WhatsApp, Chrome and Safari, and your own layouts.

- **Deleted records** recovered by FSR's own carver and DC3 SQLite Dissect.

- Save to CSV, hashed and recorded in the case and the case report.

 

### Search and recovery

- **Search Files:** tick what you are looking for (flight logs, photos, videos, **audio**, documents, databases, GPS, archives or all files) and choose the formats; clean results with filter, recover, tag and Open in SQLite Browser.

- PhotoRec carving and custom signatures, recorded in the case; right-click an image to carve it, and FSR says when it was already carved.

- **Find Drone Logs:** finds DJI flight logs on any image, live and deleted (including newer flyctrl logs such as FLY-0058-20.DAT), extracts and hashes them, and opens them in DAT.

- EXIF and SRT reports for every photo and video, with View in Maps offline (KML for Google Earth).

 

### Specialist tools

- **NAND Analyzer (NAT):** chip-off NAND dumps: JFFS2, YAFFS2, SquashFS, ext and more, with every extracted file hashed.

- **SPI Flash Analyzer (SAT):** SPI dumps hashed, mapped and searched, with PDF, XLSX and KML reports.

- **Drone (DAT):** DJI and Autel flight-log decoding and the Drone Imager, with an Autel SD-card export timer. DAT runs on its own, so FSR stays fast while it decodes.

- **GPS Forensic Tool:** acquisition from GPS devices with hashing and reports.

- **Utilities:** timestamp converter, Time Zones (daylight saving built in), Time Calculator, FFmpeg media tool and Screen Grab (hashed).

- All sub-tools share the FSR look, save into the case folder and hash what they save.

 

### Under the hood

- Crash log in `%APPDATA%\FSRTool\crash.log`.

- Third-party notices and licence texts for every bundled component (`THIRD_PARTY_NOTICES.txt`, `licenses\`).

- Python 3.10 or later.

 

*FSR uses a software write-block (Windows policy), not a hardware write blocker.*