Mobius Forensic Toolkit is a forensic framework written in Python/GTK that manages cases and case items, providing an abstract interface for developing extensions. Cases and item categories are defined using XML files for easy integration with other tools.
| Tags | Security Forensics |
|---|---|
| Licenses | GPLv2 |
| Operating Systems | OS Independent |
| Implementation | Python |
Recent releases


Changes: Extensions are now deployed in .mobius files. This release features three new extensions: Datasource SCSI, for drag'n'drop of /dev/sd* files directly into case, Data Viewer, a hexviewer for case items, and Extension Manager. Floppy Imager has been improved and uses direct I/O only. Minor improvements were made.


Changes: This release introduces the Hive extension, a registry file browser/viewer. XML pickle now encodes arbitrary dictionaries and Python objects that have circular and self references.


Changes: The extension Datasource Solo provides support to ICS Solo III image files. Case Viewer has a toolbutton to run reports. The Mobius tutorial features a new chapter on generating and running reports. Datasource-talon supports v2.40 of the software. Minor improvements were made.


Changes: The Datasource-EWF extension provides read support for EWF image files.


Changes: Case items may have an associated datasource, which represents a stream of bytes. This release also introduces Data Sourcerer, Datasource Model, Datasource Raw, and Datasource Talon extensions. Extensions now have callbacks.