New DFIR Platform Combines Digital Evidence Analysis With Local AI

A new digital-forensics platform, VESTIGEX, is bringing disk, memory, mobile and system-log analysis into a single Windows application, with an AI assistant that runs locally on the examiner’s machine.

The platform supports forensic disk images, Windows event logs, browser history, messaging artifacts, mobile-device collections and memory analysis through Volatility 3. It also includes timeline analysis, threat hunting using Sigma rules, and report generation with chain-of-custody records.

One of its distinguishing features is its offline AI workflow. According to the project’s documentation, the assistant uses locally running models through Ollama, allowing investigators to query case information without sending evidence to an external AI service.

The project launched in beta on October 8, with subsequent updates adding mobile acquisition capabilities and improvements to web-server log parsing and timeline analysis. The October 11 release added support for rotated web-server logs, which can preserve older records useful during incident investigations.

VESTIGEX is free to download, but remains beta software. Its developers advise examiners to verify significant findings with a second tool before relying on them.

The platform reflects a growing interest in combining forensic analysis and locally hosted AI while keeping sensitive evidence under the investigator’s control.