◆ Digital Forensics & Incident Response

IPED

4.3.1 open-source

IPED is an open source tool that processes and analyzes digital evidence seized at crime scenes by law enforcement or in corporate investigations.

source ↗ rss ↗ What is a cyber toolchain? last repo push Oct 7, 2026

java -jar iped.jar --webapi --host=localhost --port=8080 --sources=sources.json
[
  {
    "id": "case1",
    "path": "/data/iped-cases/case-2024-001"
  }
]
# Create a bookmark for suspicious executables
curl -X POST http://localhost:8080/bookmarks/suspicious

# Search for executables referencing passwords or encryption
curl 'http://localhost:8080/search?q=type:exe+AND+(content:password+OR+content:encrypted)'

# Add matched docs to the bookmark (supply the docs JSON array from search results)
curl -X PUT http://localhost:8080/bookmarks/suspicious/add \
  -H 'Content-Type: application/json' \
  -d '[{"source":"case1","id":42}]'
iped -s "-field1:xxx -field2:yyy"
iped --continue <path_to_case>
iped --restart <path_to_case>

Summary

IPED is an open-source digital forensics tool that processes and analyzes digital evidence gathered during investigations, distributed for free under an open-source license. It runs as a desktop application, either built from source or installed from a release, and can operate from the command line for batch processing or through an integrated analysis GUI, with cases portable enough to run from removable drives. It is aimed at law enforcement examiners and corporate investigators handling disk images, mobile extractions, and file systems, rather than at general IT or SOC teams. It sits in the digital forensics and incident response category, offering carving, indexing, timeline analysis, and parsers for chat apps like WhatsApp and Telegram, comparable to commercial forensic suites though built and maintained openly. First committed in 2015, it has 76 contributors and remains actively developed, with 561 commits and 10 releases in the past year.

IPED is an open source tool that processes and analyzes digital evidence seized at crime scenes by law enforcement or in corporate investigations.

How IPED helps

Which chat messages, calls, and contacts can I recover from a phone extraction or disk image?

parses formats like WhatsApp, Telegram, Skype, BitTorrent, and Threema directly from UFDR, AD1, or disk image containers, surfacing decoded conversations, quoted replies, and status changes in the analysis interface

Which files can I pull back out of damaged or unallocated space?

carves 40+ file formats including video, image, and archive types straight from raw disk sectors, without relying on file system metadata

Does this collection of images contain child exploitation material?

runs a dedicated CSAM detection profile combining local and remote classifiers against every image and video extracted from the case

Who is talking to whom, and when, across everything seized in this case?

builds a unified timeline across parsed evidence with event filtering and graph analysis linking communications between contacts

Can I search a hundred million seized items for a name, number, or phrase fast enough to matter?

indexes the whole case for regex search with OCR, face recognition, and similar-document matching, built to hold up at up to 400GB/h and 135 million items

Are two photos of the same object or person, taken years apart, actually connected?

matches faces across the case with recognition and age estimation, and flags visually similar images even when file names or metadata differ

all 56 features, with the evidence for each →

Languages

French, German, Italian, Spanish Release notes: French, German, Italian, Spanish French, German, Italian, Spanish added in 4.3.0 (Dec 31, 2025) · French, German, Italian, Spanish added in 4.2.1 (Apr 21, 2025) · French added in 4.2.0 (Dec 30, 2024) · German, Italian, Spanish added in 4.1.3 (Jun 30, 2023) · German, Italian, Spanish added in 4.1.0 (Feb 17, 2023)

Features

56 capabilities across 5 capability groups

Built from IPED's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

IPED covers 5 of the 8 investigation and response capabilities we track.

Disk and filesystem forensics 12 features Investigation and response since 2019

Virtual disk processing shipped Supports recursive processing and decoding of virtual disk images, including VMDK (split/differential) and VHDX formats. 5 releases · first seen Nov 2020