EvidLockV2
PL
EN
DE
CS
FR
Forensic Evidence Tool for Windows
EvidLock preserves, analyses and documents digital evidence in a single environment — from the first checksum to the finished report. All of it locally: no cloud, no account, nothing sent anywhere.
CORRELATION GRAPH — LIVE
15 RULES — every edge carries a rule, a confidence level and its stated limitations
0 bytes
sent outside your machine15 rules
of explicit evidence correlation8 modules
Player · View · Commander · Carver · Voice · Tracker · Network · SandboxSHA-256
at every stage of the workModules
Each module opens as its own window and works on the same case material — no intermediate exports, no copying paths between tools.
ElCommander
A file manager that computes checksums on the fly and warns you when the medium is writable — before you make a mistake.
RequirementsWindows 10 or 11, 64-bit. The 7-Zip component. Auto-Blocker needs administrator rights.
ElNotes
Notes pinned to case files, next to a workbench for examining text you do not want to run: indicators, hidden links, invisible characters, decoding and code preview. Nothing is executed and nothing goes out to the network.
RequirementsWindows 10 or 11, 64-bit. OCR in PDFs and images needs the Tesseract component.
ELTracker
Local analysis of iOS backups, Android trees, shared storage, backup.ab and Google Takeout without modifying the source.
ElView
Photographic material review with cropping, EXIF and HEIC metadata reading, and every file preserved with a SHA-256 checksum.
RequirementsWindows 10 or 11, 64-bit. No extra components.
ElPlayer
A player built for evidentiary material: precise CFR and VFR timeline, From–To markers, multi-camera support and split screen.
RequirementsWindows 10 or 11, 64-bit. The FFmpeg component; transcription uses the Whisper component.
ELVoice
Audio sample analysis performed entirely on your workstation. Waveform, spectrogram and a comparison of two recordings with the method stated openly.
RequirementsWindows 10 or 11, 64-bit. The FFmpeg and Whisper components, the latter with an offline model.
ELSandbox
A controlled session in the native Windows Sandbox. Only a copy of the material verified by its SHA-256 checksum reaches the guest, mounted read-only — the case folder is never mapped, so not even a malicious file can reach it. The session starts from a protection profile with the clipboard, microphone, camera, printers and vGPU switched off, and the guest running in protected mode. The results folder is mounted writable only when you ask for it, and it is the only thing that comes back from the sandbox to your workstation. After the session closes you are left with a report carrying the checksums of the copy and the results, plus the session journal — the part that goes into the case file. Before it starts, ElSandbox checks whether the environment allows it at all: the Windows edition, the state of the Sandbox feature and firmware virtualisation — and it can switch that feature on. Every session gets its own working folder with separate input, control and output subfolders.
RequirementsWindows 10 version 1903 (build 18362) or newer, in the Pro, Enterprise or Education edition — Home editions have no Windows Sandbox. The Containers-DisposableClientVM feature must be enabled and firmware virtualisation available; enabling the feature needs administrator rights and a system restart.
ElCarverin testing
Recovery of deleted files: a logical mode on NTFS, FAT32 and exFAT, and deep signature carving. The source is opened read-only.
RequirementsWindows 10 or 11, 64-bit. No extra components.
ELNetwork
Analysis of PCAP captures with Suricata and Zeek in a single pass. The capture stays untouched.
RequirementsWindows 10 or 11, 64-bit. The TShark/Wireshark component.
EvidLock organises and correlates artefacts, but it does not automatically attribute actions to a person. Every link in the graph carries an explicit rule, a confidence level and its stated limitations — you draw the conclusions and you defend them.