EvidLockV2

Forensic Evidence Tool for Windows

Safe workwith digital evidence

EvidLock preserves, analyses and documents digital evidence in a single environment — from the first checksum to the finished report. All of it locally: no cloud, no account, nothing sent anywhere.

See the releases See what ends up in the case file

CORRELATION GRAPH — LIVE

15 RULES — every edge carries a rule, a confidence level and its stated limitations

0 bytes

sent outside your machine

15 rules

of explicit evidence correlation

8 modules

Player · View · Commander · Carver · Voice · Tracker · Network · Sandbox

SHA-256

at every stage of the work

Who it is for

Built for law enforcement. Open to anyone working with digital evidence.

Repeatable procedure, a legible audit trail and a demonstrable link between finding and source — these are the demands of criminal proceedings. The same demands apply to the expert witness, the incident response team, the auditor and the student still learning the method.

Law enforcement

Media preservation, a repeatable sequence of steps and documentation ready for the case file.

Expert witnesses and law firms

Opinions grounded in verifiable checksums, with interpretive limits stated openly.

IT security teams

Incident response and artefact analysis without moving data outside the organisation.

Audit and compliance

Material inventory, integrity control and reports for internal proceedings.

Investigators and assessors

A complete workbench on a single laptop, working without any network access.

Students of cyber programmes

Cybersecurity, digital forensics and technology law — a full workbench on your own laptop.

Universities and training

One environment for classes on media preservation and timeline building, with no network required.

CTF teams and researchers

Carving, memory analysis, YARA rules and a correlation graph in one place.

Modules

Eight independent workbenches in one application

Each module opens as its own window and works on the same case material — no intermediate exports, no copying paths between tools.

ElPlayer

Surveillance footage, frame by frame

A player built for evidentiary material: precise CFR and VFR timeline, From–To markers, multi-camera support and split screen.

frame captures to JPG and export of a selected range
analysis form with annotations stored alongside the recording
keyboard shortcuts for frame-by-frame work

ElPlayer — player window with timeline, From–To markers and tool panel

ElCommander

Dual-pane inventory with evidence mode

A file manager that computes checksums on the fly and warns you when the medium is writable — before you make a mistake.

directory comparison and difference detection
SHA-256 for selected files and entire trees
ZIP AES-256, 7Z and TAR.GZ archives, plus preservation into the case

ElCommander — two file panes, evidence mode and checksum bar

ElCarver

Recovering deleted files

Two modes: fast logical recovery on NTFS, FAT32 and exFAT, and deep signature carving. The source is opened strictly read-only.

images, recordings, documents, archives and office formats
physical disks as well as RAW, E01 and AFF4 images
verification of recovered files that rejects false hits

ElCarver — source selection, scan mode and formats to recover

ElView

Reviewing and preserving photographs

Photographic material review with cropping, EXIF and HEIC metadata reading, and every file preserved with a SHA-256 checksum.

interactive reports with markers placed on the photographs
image and camera metadata analysis
direct hand-off from ElCarver results

Single image analysis: EXIF metadata, SHA-256 and photograph authenticity assessment

ELVoice

Voice recordings: description and comparison

Audio sample analysis performed entirely on your workstation. Waveform, spectrogram and a comparison of two recordings with the method stated openly.

twenty audio and video formats, including AMR, Opus and the audio track of an MP4
waveform and spectrogram saved as files for the report
comparison result with a verbal band and its limitations spelled out

See a sample ELVoice report

ELVoice Forensics — voice sample analysis window with waveform and spectrogram

ELTracker

Mobile traces from multiple preserved sources

Local analysis of iOS backups, Android trees, shared storage, backup.ab and Google Takeout without modifying the source.

recordings and voice-activity transcripts
contacts, accounts, SIM data, Chrome queries and autofill
HTML, PDF, XLSX, CSV and JSON reports with a SHA-256 manifest

ELNetwork

A traffic capture, two engines at once

PCAP analysis by Suricata and Zeek in a single run. The capture is never altered and every run gets its own manifest.

alerts, connections, DNS, HTTP, TLS and files in one view
results from both engines merged and ordered in time
CSV and HTML export plus SHA-256 of the capture and the rules used

ELSandbox

An unknown file runs outside your system

A controlled session inside the native Windows Sandbox. Only a SHA-256 verified copy of the material reaches the guest, read-only — the case folder is never mapped.

clipboard, microphone, camera, printers and vGPU disabled
networking offline, direct or through a proxy — offline by default
HTML report with SHA-256 of the copies and results plus the session journal

Isolation model

See what enters the sandbox — and what never will

Set the session up the way you would in the module. The diagram and the .wsb configuration below change exactly the way ELSandbox changes them — this is the same set of decisions, not an illustration.

Network mode Offline Direct Through a proxy

Tools in the sandbox Process Monitor Wireshark

Session settings Persistent output folder Behaviour monitoring requires a persistent output folder

The default and the recommended mode for an unknown file. The guest has no network, so the examined program cannot reach a command server or pull down the rest of its payload.

The guest uses the network shared by Windows Sandbox. Traffic from the examined program leaves the machine — this mode makes sense only when you deliberately want to observe those connections.

The proxy is a setting inside the guest — WinINET, WinHTTP and environment variables — not a filter enforced from outside. The examined program may ignore it, use another protocol or connect directly. Controlling traffic requires network segmentation on the infrastructure side.

The ElSandbox_secure.wsb configuration for these settings

<Configuration>
  <VGpu>Disable</VGpu>
  <Networking>DisableEnableEnable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>%LOCALAPPDATA%\EvidLock\ElSandbox\sessions\20260827_014522_9f3ac1b8\input</HostFolder>
      <SandboxFolder>C:\EvidLock\Input</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
    <MappedFolder>
      <HostFolder>%LOCALAPPDATA%\EvidLock\ElSandbox\sessions\20260827_014522_9f3ac1b8\control</HostFolder>
      <SandboxFolder>C:\EvidLock\Control</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
    <MappedFolder>
      <HostFolder>D:\Sprawy\PR-2-Ds-114-2026\ElSandbox_Output_20260827_014522_9f3ac1b8</HostFolder>
      <SandboxFolder>C:\EvidLock\Output</SandboxFolder>
      <ReadOnly>false</ReadOnly>
    </MappedFolder>
    <MappedFolder>
      <HostFolder>C:\Program Files\Sysinternals</HostFolder>
      <SandboxFolder>C:\EvidLock\Tools\procmon</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
    <MappedFolder>
      <HostFolder>C:\Program Files\Wireshark</HostFolder>
      <SandboxFolder>C:\EvidLock\Tools\wireshark</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File C:\EvidLock\Control\bootstrap.ps1</Command>
  </LogonCommand>
  <AudioInput>Disable</AudioInput>
  <VideoInput>Disable</VideoInput>
  <PrinterRedirection>Disable</PrinterRedirection>
  <ClipboardRedirection>Disable</ClipboardRedirection>
  <ProtectedClient>Enable</ProtectedClient>
  <MemoryInMB>4096</MemoryInMB>
</Configuration>

Timeline and evidence graph

Thousands of events resolve into one story

Activity profiling brings EVTX events, registry, Prefetch, LNK, Jump Lists, ShellBags, USBSTOR, Amcache, ShimCache, SRUM, processes, network connections and browsers into a single UTC timeline.

Deterministic correlation

You always know why two things were linked

A local graph works over the normalised records with 15 explicit correlation rules. Clicking an edge reveals the rule, its confidence level, an explanation, the limitations and the evidence identifiers.

a “Why were these linked?” panel on every relation
versioned MITRE ATT&CK 19.1 mapping
export to JSON, standalone HTML, XLSX and a SHA-256 checksum file

Timeline and evidence correlation graph with the rule explanation panel

Plaso

A complete timeline from a media image

You point to a media image and EvidLock builds a full timeline from it, loading the result straight into the correlation graph. No shuffling files between tools.

the source is opened strictly read-only
progress visible as the work runs
results appear immediately in the timeline and graph

Plaso timeline creation window with live progress

Plaso integration. The timeline is built entirely on your own workstation and the source material remains untouched. The feature is available regardless of the chosen installation variant.

Volatile memory

What disappears the moment power is cut

Encryption keys, open connections, running processes and content that never touched the disk exist only in memory. Capturing it is a step that cannot be repeated.

Capture and analysis

WinPmem and Volatility 3 in one window

Memory captured with WinPmem, with visible progress and a SHA-256 checksum computed immediately. Analysis runs directly on the acquired image.

ready plugins: processes, network, command lines, Malfind, module list
optional acquisition of pagefile.sys, swapfile.sys and hiberfil.sys
reports in TXT, CSV, XLSX, HTML and PDF

Memory module: WinPmem capture, SHA-256 checksum and Volatility 3 plugins

HEX viewer

Twenty gigabytes without loading them into memory

A paged HEX view of the capture — the image is never read in full, so a file tens of gigabytes in size opens instantly.

jump to any address and page-by-page navigation
text search as ASCII, UTF-16 LE and raw HEX bytes
hit list with address, type and context preview

HEX view of a memory capture with paged reading and string search

Image manager

Two captures side by side, one answer

Comparison of two memory images: SHA-256 computed for both and presented next to each other. It lets you demonstrate that a copy is faithful to the original.

name, path, size and dates of both captures side by side
computing and comparing checksums
choosing which image is passed on for further analysis

Memory manager: two RAM captures compared by SHA-256

The module is marked beta. Memory capture requires administrator rights and always alters the state of the examined system — it cannot be acquired without leaving a trace. We say so plainly, because that circumstance belongs in the record of the procedure.

Reports and event journal

Every action leaves a trace — and writes itself into the documentation

Evidentiary work does not end at the finding, but at whether that finding can be reproduced and demonstrated. EvidLock records the course of work as it happens.

Event journal

A continuous record of the work

Every operation enters the journal with its time, level, sequence number, module and duration. The record is written as you work, so the report is not a separate task at the end of the day.

live filtering by entry content
interactive HTML report with sorting
journal export to PDF and XLSX
final case report gathering the whole sequence of steps
counters for files, reports and entries in the case panel

View a sample HTML report

Event journal window: entries with time, level, sequence number and module

Windows logs

Exporting system logs into the case file

Application, security, setup and system events exported with a chosen time range and record limit.

XLSX, EVTX, PDF and TXT in a single pass
SHA-256 checksums and a read-only attribute on the output files
range from the last 24 hours to a custom date span

System log export options with SHA-256 checksums

The documentation is ready for the case file immediately — with no manual tidying, retyping or computing checksums in a separate tool.

Scope of work

From securing the medium to the final report

Material integrity

SHA-256 for files and directories, deterministic manifests, BLAKE3 for fast inventory, MD5 kept solely as a compatibility value.

One-Click

One click: read-only attribute, encryption check, checksums, manifest, report and a password-protected archive.

RAM memory

Capture via WinPmem, optionally pagefile, swapfile and hiberfil, analysis in Volatility 3 and checksums. Module in beta.

Media images

Imaging disks and volumes to RAW/ISO, mounting, comparing images and reading E01/Ex01 and AFF4.

Case analysis

A shared database for seven independent scans: file signatures, encryption, hash sets, YARA, SQLite journals, phone backups and Sleuth Kit.

Browsers

History, bookmarks, downloads, cookies, cache and saved-password metadata, with a risky-content filter.

Registry and Windows logs

Registry export to .hiv, CSV, XLSX, TXT and PDF, and system logs to XLSX, EVTX, PDF and TXT.

Content search

Multi-threaded phrase search across names and inside text, PDF, Office, OpenDocument and EML files.

Reports and journal

PDF, CSV, TXT and XLSX reports, a final case report and an operations journal with an interactive HTML report.

Encryption detection

BitLocker, LUKS, FileVault and encrypted archives, documents and keys. Containers without a signature are reported as suspicion, never as certainty.

SQLite journal recovery

Addresses, contacts and paths extracted from WAL and journal files — from writes that have not yet reached the browser or messenger database.

Phone backups

Recognising iTunes/Finder and adb backups: device model, system version, backup date, file count and encryption status.

Voice analysis

Describing the properties of a recording and comparing two samples with a waveform and spectrogram. The result is an indication, never speaker identification.

Network traffic

PCAP captures analysed by Suricata and Zeek: alerts, connections, DNS, HTTP, TLS and files in one view, with a manifest that lets the analysis be repeated.

Isolated execution

An unknown file opened in the native Windows Sandbox: a verified read-only copy, networking off by default, the case folder never mapped.

Releases

EvidLock for Windows

One application installer, three portable variants and four modules with their own installers. All share the same engine and the same case format.

Testing phase. EvidLock has no production release yet — testing is under way, and the scope and behaviour of the modules may still change.

Downloads on hold — The files will be published once code signing is finished and the SHA-256 checksums are available.

Main application

INSTALL
PORTABLE ONEDIR
PORTABLE ONEFILE
PORTABLE SFX

Modules with their own installer

ElCommander + ElFTP
ElNotes
ElVoice
ElPlayer

Release details on evidlock.pl

Installer or portable? The installer registers the program in the system, creates shortcuts and handles updates. The portable build runs from a USB stick, with no installation — but it starts noticeably slower, because it unpacks itself on every launch.

Every commercial release requires an ELP1 key. Without a key the program starts in demonstration mode with a limited number of launches.

Full release descriptions, requirements and checksums are on evidlock.pl. Before running a file, compare its SHA-256 sum with the value published next to the release.

Security

The analysis stays local

EvidLock processes the material on the operator’s computer. The update server serves nothing but program files, and the ELP1 activation server handles the licence and pseudonymous identifiers — it never receives the files being analysed.

Integrity

Installers come with published SHA-256 checksums. Production updates additionally require a valid Authenticode signature.

Minimisation

The activation API accepts only the data needed to verify the device and run limits.

Separation

The website, the update files and the licence console run on separate subdomains.

Audit

Issued extensions and server decisions are written to a controlled journal.

Honestly, about the limits of the tool

EvidLock organises and correlates artefacts, but it does not automatically attribute actions to a person. Every link in the graph carries an explicit rule, a confidence level and its stated limitations — you draw the conclusions and you defend them.

Release details on evidlock.pl Contact