Desktop build
macOS
The native macOS build for Macs with Apple silicon, packaged as a disk image.
Apple siliconDMG
ForensicXLab software
Downloads
Download the Thanatology desktop application or the Exhume CLI tools for your platform.
- Thanatology
- Exhume framework
Desktop applicationVersion 26.1.0
Thanatology
A digital forensics workspace powered by Exhume. Download the installer for your platform and investigate evidence from one desktop application.
Documentation
Desktop build
Windows
A guided desktop installer for 64-bit Windows systems.
64-bitSetup EXE
Desktop build
Linux
Run the portable AppImage or install the native package on Debian-based distributions.
x86_64AppImage / DEB
Command-line tools13 modules
Exhume framework
Standalone CLI executables for reading evidence, exploring filesystems, extracting artefacts, and analysing memory. Choose a module, your platform, and your processor architecture.
exhume_body
CLIRead disk images and evidence sources through one common interface.
Documentationexhume_partitions
CLIInspect GPT, MBR, and extended partition tables to locate partitions.
Documentationexhume_lvm
CLIInspect LVM metadata and access logical volumes within evidence.
Documentationexhume_filesystem
CLIBrowse filesystems and export files, directories, and volumes.
Documentationexhume_apfs
CLIRead APFS containers, volumes, files, and filesystem metadata.
Documentationexhume_exfat
CLIRead files, directories, and metadata from exFAT filesystems.
Documentationexhume_extfs
CLIRead files, directories, and metadata from Extended Filesystems.
Documentationexhume_ntfs
CLIRead files, directories, and metadata from NTFS filesystems.
Documentationexhume_artefacts
CLIExtract structured records from operating-system and application artefacts.
Documentationexhume_indexer
CLIIndex filesystem metadata in SQLite and coordinate artefact extraction.
Documentationexhume_grep
CLISearch indexed file contents with literal or regular-expression patterns.
Documentationexhume_memory
CLIAcquire and analyse volatile memory through memflow connectors.
Documentationexhume_agent
CLIWork with a forensic assistant and Exhume tools from your terminal.
Documentation