Archive of Forensics Analysis Tools

J.A.F.A.T. is a collection of tools to assist in the forensic investigation of computer systems.


SFT 1.1.6 has been released


SFT 1.1.6 has been released. This new version fixes a bug in safari_cookie_bin.pl

SFT 1.1.5.tar.gz source code has been re-released


The original 5/27/12 SFT-1.1.5.tar.gz release had a syntax error in the top level Makefiel.OSX that prevented it from compiling on OSX. (Thanks to Cristina Roura for reporting this.). The error has been fixed in the 6/2/12 re-release of the SFT-1.1.5.tar.gz source code.

SFT 1.1.5 has been released


SFT 1.1.5 has been released. The safari_cookie_bin.pl script was added to parse Cookies.binarycookies files

SFT 1.1.4 debian package


The SFT 1.1.4 Debian package for the SANS SIFT has been added to the download site. This package allows investigators to easily install SFT on a SANS SIFT workstation.

SFT 1.1.4 released


SFT (Safari Forensic Tools) version 1.1.4 has been released. The safari_top and last_session programs were added in this version to parse the Safari TopSites.plist and LastSession.plist files.