forefst

Free plan LinuxWindows

What forefst is

forefst is a free, open-source forensic toolkit and byte-level reference for Microsoft ReFS versions 3.4 through 3.14. It runs on Linux and Windows and reads raw ReFS volume images, raw disks or partitions, and E01 images exported to raw. The tools access these sources directly without a driver, mount, or third-party dependency. forefst.py lists files and directories with metadata in CSV, Sleuthkit body-file, or JSON formats. It supports deleted-file recovery through five methods and can recover earlier file versions through copy-on-write. File timestamps, the USN change journal, and the MLog transaction log can form a super-timeline, with timestamp anomalies flagged. The toolkit extracts content and artifacts such as security descriptors, reparse points, stream snapshots, and Recycle Bin items. refsanalysis.py decodes ReFS structures and includes boot-sector inspection and repair mode. Both tools require Python 3.7 or later.

Who it suits

It suits forensic analysts examining raw ReFS volumes and images on Linux or Windows, especially when structured reports and recovery are needed.

What it does well

Parses ReFS versions 3.4 through 3.14
Reads raw sources without drivers or mounts
Exports metadata as CSV, body-file, or JSON
Provides deleted-file and prior-version recovery
Includes timeline and ReFS structure analysis

What to know first

Requires Python 3.7 or later
Known issues in version 1.13.1 may affect examiner reports
Focused on Microsoft ReFS forensic analysis
Released under GNU GPL version 3.0 or later

Verdict

forefst provides direct, dependency-light ReFS examination with reporting, recovery, timeline construction, and artifact extraction. Review the project’s known issues before relying on version 1.13.1 for examiner reports.

Facts from forefst's own pages

Artifacts: It can extract file content and artifacts including security descriptors, reparse points, stream snapshots, and Recycle Bin items. · xbpt.gitlab.io, 12 Oct 2026
Auditability: The project says every printed field traces to a graded evidence claim register, with evidence checked against the decompiled driver and raw disk images. · xbpt.gitlab.io, 12 Oct 2026
Companion tool: refsanalysis.py decodes individual ReFS structures and includes boot-sector inspection and repair mode. · xbpt.gitlab.io, 12 Oct 2026
Dependencies: Both tools use Python 3.7 or later and the standard library, with no third-party dependencies. · xbpt.gitlab.io, 12 Oct 2026
Evidence and verification: The project says structural claims were checked against the decompiled refs.sys driver and a lab corpus of disk images, and are traceable to evidence. · xbpt.gitlab.io, 12 Oct 2026
File metadata: forefst.py lists file metadata in CSV, Sleuthkit body-file, or JSON formats. · xbpt.gitlab.io, 12 Oct 2026
File reports: forefst.py lists files and directories with metadata in CSV, Sleuthkit body-file, or JSON formats. · xbpt.gitlab.io, 12 Oct 2026
Free plan: Yes · github.com, 19 Sept 2026
Input: The tools read a raw ReFS image or volume directly without a driver, mount, or third-party dependencies. · xbpt.gitlab.io, 12 Oct 2026
Intended users: The maker describes the project as a resource for ReFS forensic analysis, including analysts examining raw ReFS volumes. · xbpt.gitlab.io, 12 Oct 2026
Known issue: The project README identifies known issues in version 1.13.1 that may affect examiner reports. · github.com, 12 Oct 2026
License: The tools are released under the GNU General Public License version 3.0 or later. · xbpt.gitlab.io, 12 Oct 2026
Origin: The project began as Baptiste Bonnet’s master’s thesis at the University of Mons in 2026. · xbpt.gitlab.io, 12 Oct 2026
Purpose: forefst is an open-source forensic tool and byte-level reference for Microsoft ReFS versions 3.4 through 3.14. · xbpt.gitlab.io, 12 Oct 2026
Raw volume analysis: The tools read a raw ReFS image or volume directly without a driver, mount, or third-party dependencies. · xbpt.gitlab.io, 12 Oct 2026
Recovery: forefst.py supports deleted-file recovery through five methods and can recover prior file versions through copy-on-write. · xbpt.gitlab.io, 12 Oct 2026
Security and privacy: The project site says it uses GoatCounter for anonymous, cookie-less visitor counts with no personal data or cross-site tracking. · xbpt.gitlab.io, 12 Oct 2026
Recovery sources: raw ReFS volume images,raw disks or partition devices,and E01 images exported to raw · github.com, 19 Sept 2026
Support: The maker invites bug reports and corrections through the project issue tracker. · xbpt.gitlab.io, 12 Oct 2026
Supported formats: The project says it parses ReFS versions 3.4 through 3.14 and is validated on ReFS 3.14. · xbpt.gitlab.io, 12 Oct 2026
Timelines: The tool can combine file timestamps, the USN change journal, and the MLog transaction log into a super-timeline and flag timestamp anomalies. · xbpt.gitlab.io, 12 Oct 2026

Where forefst stands on Freedom251

Data recovery software#72 of 128