- Home
- Data recovery software
- forefst
On the recordRead 12 Oct 202621 facts
forefst
On the record
- Artifacts
- It can extract file content and artifacts including security descriptors, reparse points, stream snapshots, and Recycle Bin items.xbpt.gitlab.io · read 12 Oct 2026
- Auditability
- The project says every printed field traces to a graded evidence claim register, with evidence checked against the decompiled driver and raw disk images.xbpt.gitlab.io · read 12 Oct 2026
- Companion tool
- refsanalysis.py decodes individual ReFS structures and includes boot-sector inspection and repair mode.xbpt.gitlab.io · read 12 Oct 2026
- Dependencies
- Both tools use Python 3.7 or later and the standard library, with no third-party dependencies.xbpt.gitlab.io · read 12 Oct 2026
- Evidence and verification
- The project says structural claims were checked against the decompiled refs.sys driver and a lab corpus of disk images, and are traceable to evidence.xbpt.gitlab.io · read 12 Oct 2026
- File metadata
- forefst.py lists file metadata in CSV, Sleuthkit body-file, or JSON formats.xbpt.gitlab.io · read 12 Oct 2026
- File reports
- forefst.py lists files and directories with metadata in CSV, Sleuthkit body-file, or JSON formats.xbpt.gitlab.io · read 12 Oct 2026
- Input
- The tools read a raw ReFS image or volume directly without a driver, mount, or third-party dependencies.xbpt.gitlab.io · read 12 Oct 2026
- Intended users
- The maker describes the project as a resource for ReFS forensic analysis, including analysts examining raw ReFS volumes.xbpt.gitlab.io · read 12 Oct 2026
- Known issue
- The project README identifies known issues in version 1.13.1 that may affect examiner reports.github.com · read 12 Oct 2026
- License
- The tools are released under the GNU General Public License version 3.0 or later.xbpt.gitlab.io · read 12 Oct 2026
- Origin
- The project began as Baptiste Bonnet’s master’s thesis at the University of Mons in 2026.xbpt.gitlab.io · read 12 Oct 2026
- Purpose
- forefst is an open-source forensic tool and byte-level reference for Microsoft ReFS versions 3.4 through 3.14.xbpt.gitlab.io · read 12 Oct 2026
- Raw volume analysis
- The tools read a raw ReFS image or volume directly without a driver, mount, or third-party dependencies.xbpt.gitlab.io · read 12 Oct 2026
- Recovery
- forefst.py supports deleted-file recovery through five methods and can recover prior file versions through copy-on-write.xbpt.gitlab.io · read 12 Oct 2026
- Security and privacy
- The project site says it uses GoatCounter for anonymous, cookie-less visitor counts with no personal data or cross-site tracking.xbpt.gitlab.io · read 12 Oct 2026
- Recovery sources
- raw ReFS volume images,raw disks or partition devices,and E01 images exported to rawgithub.com · read 19 Sep 2026
- Support
- The maker invites bug reports and corrections through the project issue tracker.xbpt.gitlab.io · read 12 Oct 2026
