forefst
The facts below are what the maker publishes about forefst, checked and dated. Our editors have not written about it yet.
The facts
Each one read from forefst's own pages, with the date it was checked.
What it does
- Artifacts
- It can extract file content and artifacts including security descriptors, reparse points, stream snapshots, and Recycle Bin items.checked 12 Oct 2026
- Auditability
- The project says every printed field traces to a graded evidence claim register, with evidence checked against the decompiled driver and raw disk images.checked 12 Oct 2026
- Companion tool
- refsanalysis.py decodes individual ReFS structures and includes boot-sector inspection and repair mode.checked 12 Oct 2026
- Dependencies
- Both tools use Python 3.7 or later and the standard library, with no third-party dependencies.checked 12 Oct 2026
- Evidence and verification
- The project says structural claims were checked against the decompiled refs.sys driver and a lab corpus of disk images, and are traceable to evidence.checked 12 Oct 2026
- File metadata
- forefst.py lists file metadata in CSV, Sleuthkit body-file, or JSON formats.checked 12 Oct 2026
- File reports
- forefst.py lists files and directories with metadata in CSV, Sleuthkit body-file, or JSON formats.checked 12 Oct 2026
- Input
- The tools read a raw ReFS image or volume directly without a driver, mount, or third-party dependencies.checked 12 Oct 2026
- Intended users
- The maker describes the project as a resource for ReFS forensic analysis, including analysts examining raw ReFS volumes.checked 12 Oct 2026
- Known issue
- The project README identifies known issues in version 1.13.1 that may affect examiner reports.checked 12 Oct 2026
- License
- The tools are released under the GNU General Public License version 3.0 or later.checked 12 Oct 2026
- Origin
- The project began as Baptiste Bonnet’s master’s thesis at the University of Mons in 2026.checked 12 Oct 2026
- Purpose
- forefst is an open-source forensic tool and byte-level reference for Microsoft ReFS versions 3.4 through 3.14.checked 12 Oct 2026
- Raw volume analysis
- The tools read a raw ReFS image or volume directly without a driver, mount, or third-party dependencies.checked 12 Oct 2026
- Recovery
- forefst.py supports deleted-file recovery through five methods and can recover prior file versions through copy-on-write.checked 12 Oct 2026
- Recovery sources
- raw ReFS volume images,raw disks or partition devices,and E01 images exported to rawchecked 19 Sep 2026
- Security and privacy
- The project site says it uses GoatCounter for anonymous, cookie-less visitor counts with no personal data or cross-site tracking.checked 12 Oct 2026
- Support
- The maker invites bug reports and corrections through the project issue tracker.checked 12 Oct 2026
- Supported formats
- The project says it parses ReFS versions 3.4 through 3.14 and is validated on ReFS 3.14.checked 12 Oct 2026
- Timelines
- The tool can combine file timestamps, the USN change journal, and the MLog transaction log into a super-timeline and flag timestamp anomalies.checked 12 Oct 2026
Money
- Free plan
- Yeschecked 19 Sep 2026
Alternatives to forefst
- 1
EaseUS Data Recovery Wizard
Free planAndroidiOSmacOSWindows9.0Free plan - 2
Disk Drill
Free planmacOSWindows8.4From $89 a year - 3
MiniTool Power Data Recovery
Free planmacOSWindows8.2From $89 a year - 4
DoYourData Recovery
Free planiOSmacOSWindows8.2From $69 a year - 5
AOMEI FastRecovery
Free planWindows8.1Free plan - 6
Hetman Partition Recovery
LinuxmacOSWindows7.9$97.95 one-time