sepinf-inc/IPED

IPED is a digital forensics tool that processes and analyzes digital evidence seized during criminal investigations or corporate examinations.

The tool addresses the need for efficient, stable processing of large volumes of digital evidence. It works by accepting disk images in multiple formats through integration with the Sleuthkit Library, then performing multithread processing to extract, index, and organize evidence for analysis. The approach emphasizes batch processing via command line for case creation, combined with an integrated graphical interface for investigation and review. Support extends across multiple disk image formats including RAW, E01, ISO9660, AFF, VHD, VMDK, EX01, VHDX, UDF, AD1, and UFDR.

Law enforcement agencies and private examiners handling large-scale evidence processing should consider this tool, particularly those working with cases involving hundreds of gigabytes or millions of individual items. The tool's portability—cases run directly from removable drives without installation—suits field operations and distributed investigations. Its multiplatform support on Windows and Linux provides flexibility in deployment environments. Organizations already using Sleuthkit or AccessData formats will find natural integration points.

Development activity shows a mature, production-focused project with deep roots in forensic practice. The codebase maintains stability as a core principle, with the master branch explicitly marked as unstable development code while release tags provide stable versions for deployment. The project welcomes contributions and maintains documented guidelines for external developers. The tool originated from and continues to be developed by digital forensic experts, grounding its design in real investigative workflows rather than theoretical approaches.