winget install --id=kalink0.Crush -e Open-source desktop workbench for digital forensic analysis
Crush — Digital Forensic Analysis Workbench
Open and navigate ZIP, TAR, 7z, Android adb backup (.ab), and iTunes/Finder iOS backup archives, folders, and individual files without extracting anything to disk first. Mobile backups are reconstructed as the original device filesystem — iOS backups rebuild the domain/relativePath tree from Manifest.db instead of the flat, hash-named layout on disk; Android backups unpack as a regular filesystem tree.
Password-protected archives — ZIP (both legacy ZipCrypto and WinZip AES), 7z, encrypted Android backups, and password-protected iTunes backups all prompt for a password when opened, with a retry on a wrong one.
Built-in file format database — Crush identifies forensically relevant formats by magic bytes and extension, and shows format name, platform, forensic relevance, and a link to the specification for every selected file, including formats without a dedicated viewer.
Value Inspector — shows every plausible interpretation of a pasted or selected value at once: integers, floats, a dozen timestamp epochs, UUIDs, network addresses, and byte sizes (decimal and binary). On Linux, it updates automatically from any text you highlight.
BLOB Inspector — chain byte-level transforms (Base64/hex decode, zlib/gzip/lzfse decompress) and render the result as hex, text, JSON, XML, plist, ABX, or Protobuf (schema-less or schema-based) — available on any BLOB cell or pasted value throughout Crush.
Integrity mode — optional hashing for auditability: file/ZIP/TAR sources are hashed on open and exports generate a hash manifest (crush-export-hashes.txt). Toggle via the bottom-right status badge.
Send to Peach — hand a log source (Apple Unified Log, or any other file — same "no pre-filtering, confirm in the tool itself" approach as Multi-Log Studio) off to the bundled sibling log viewer peach-forensics for tagging and Splunk-style search, via right-click.
Supported viewers (more planned):
→ User Handbook → Format Support & Parser Limitations
Technical write-ups on the crush viewers — forensic background, workflow, and what to look for:
Android ABX (Linux)
Android Video (Linux)
Loading Speed - How fast we can load from zips
iOS SEGB (Windows)
iOS SQLite Summary (Windows)
Format Reference (Linux)
Integrity Mode (Linux)
BLOB Inspector (Linux)
Value Inspector (Linux)
macOS (Homebrew)
brew tap kalink0/forensics
brew trust kalink0/forensics
brew install --cask crush-forensics
Windows (winget)
winget install kalink0.Crush
Windows (Scoop)
scoop bucket add forensics https://github.com/kalink0/scoop-forensics
scoop install forensics/crush-forensics
No native package for Linux yet — grab the AppImage from Releases.
python -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install -e .
.tracev3 / .logarchive support)python scripts/download_unifiedlog_binaries.py
python scripts/download_peach_binaries.py
crush
python -m crush
If you see missing Qt or media errors, install the system dependencies below.
crush /path/to/evidence.zip /path/to/case_folder
crush --open /path/to/evidence.zip --open /path/to/case_folder
Positional paths and --open PATH (repeatable) are equivalent — each opens
that file or folder on startup, added to the same window's tree. Every
invocation opens a new window.
Some Python packages require OS-level libraries on fresh machines.
These are required for the Qt GUI to run correctly on Linux.
sudo apt-get install libgl1 libegl1 libxcb-xinerama0 libxkbcommon-x11-0sudo dnf install mesa-libGL mesa-libEGL libxcb libxkbcommon-x11sudo pacman -S mesa libglvnd libxcb libxkbcommon-x11python-magic)python-magic depends on libmagic being present on the system.
sudo apt-get install libmagic1sudo dnf install file-libssudo pacman -S filebrew install libmagicPySide6 uses system multimedia backends.
sudo apt-get install gstreamer1.0-plugins-base gstreamer1.0-plugins-goodsudo dnf install gstreamer1-plugins-base gstreamer1-plugins-goodsudo pacman -S gstreamer gst-plugins-base gst-plugins-goodgstreamerFor Linux audio playback, libpulse is commonly required by Qt Multimedia.
sudo apt-get install libpulse0sudo dnf install pulseaudio-libssudo pacman -S libpulseThis project builds on the great work of the DFIR community. The following third-party modules by CCL Solutions Group are bundled:
Apple Unified Log (.tracev3 / .logarchive) parsing uses the macos-UnifiedLogs unifiedlog_iterator binary by Mandiant (Apache License 2.0). The binary is bundled automatically in portable builds. When running from source, run scripts/download_unifiedlog_binaries.py to download the platform binaries into crush/bin/unifiedlog_iterator/ (they are git-ignored and never committed).
MMKV parsing is built on mmkv-parser by Alexis Brignoni (MIT License), vendored unmodified under crush/third_party/mmkv_parser/.
Send to Peach hands log sources off to peach-forensics, a sibling forensic log viewer (Apache License 2.0) — tagging, Splunk-style search, no IPC after launch. Sessions aren't persisted for sources Crush had to extract or decrypt first (--ephemeral-session), so a handoff never leaves a durable, unencrypted copy of evidence behind. The binary is bundled the same way as unifiedlog_iterator; run scripts/download_peach_binaries.py when running from source to populate crush/bin/peach/.
Special thanks to @dugeonlady for suggesting the Rainbow theme — because digital forensics tools don't have to be grey. Or dark. Someone has to bring colour to the hex dump. Evidence: View → Theme → Rainbow. She was right.
Parts of this software were developed with assistance from Claude AI / Claude Code by Anthropic.
Use GitHub Issues. Please include the Crush version (shown in Help → About), your OS, and steps to reproduce.