Look inside any file.
Six forensic tools you can use right here: pick one, drop in a file and get the answer in plain English. Files are read in memory and deleted straight away. They are never stored.
File Type Detector
Checks the first bytes of a file to find its real type, and warns you when the name lies, like a program renamed to invoice.pdf.
Which file?
Any file. Good for email attachments and downloads you aren’t sure about.
File Entropy
Measures how random the bytes are, from 0 to 8. Encrypted files (and files locked by ransomware) score almost exactly 8.
Which file?
Any file. Zip, JPG, MP4 and other compressed files are always near 8, and that is normal.
File Hash
Works out the file’s fingerprints (MD5, SHA-1, SHA-256 and more). Paste the hash the download site publishes to check the file wasn’t changed.
Which file?
Any file. Most sites publish a SHA-256 next to the download link.
Browser History Reader
Reads a browser’s history file: the pages visited, files downloaded, searches made and bookmarks, newest first.
Which file?
Close the browser first. Chrome: %LOCALAPPDATA%\Google\Chrome\User Data\Default\History · Edge: %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History · Firefox: places.sqlite in %APPDATA%\Mozilla\Firefox\Profiles\ · Safari: ~/Library/Safari/History.db
Registry Hive Reader
Opens a Windows registry file so you can browse its keys and values, with the time each key last changed, and digs out keys and values that were deleted.
Which file?
Windows locks the live files, so save a copy: in a Command Prompt run as administrator type reg save HKCU C:\temp\user.hiv and upload user.hiv. Copies of NTUSER.DAT, SOFTWARE or SYSTEM from a backup or another drive work too.
Event Log Reader
Reads a Windows event log: sign-ins, failed passwords, new accounts, services installed, logs being cleared and more, with filters.
Which file?
In Event Viewer right-click a log (for example Windows Logs → Security), choose Save All Events As… and save it as .evtx. The live files are in C:\Windows\System32\winevt\Logs\.
Choose a file and the results appear here.
Good to know
Do you keep my files?
No. The file is read in memory on our server, the answer is sent back to you, and the file is deleted. Nothing about its contents is saved or logged. The browser history reader writes a temporary copy for the moment it takes to read it, then deletes that too.
Is it safe to upload a file I think is malware?
Yes. The tools only read the file’s bytes. Nothing is ever opened, run or unpacked. Web addresses in browser history are shown as plain text and are never turned into links.
Why does my browser history say it can’t be read?
The browser locks the file while it is open. Close the browser completely (check the system tray too) or copy the History file somewhere else first, then upload the copy.
Is there a limit?
Files up to 20 MB, and up to 60 checks every 10 minutes from one network. For bigger jobs or automation, use the forensics APIs with an API key.