Home / Portfolio / DriveWitness
Forensic software

DriveWitness

A software concept for periodic drive inventory, file-hash baselines and change-history records.

2026-10-28·Forensic software·drivewitness
Project profile: reported work and stated aims are not equivalent to independent certification or operational verification.

Purpose and public position

A software concept for periodic drive inventory, file-hash baselines and change-history records.

Technical and editorial priorities

Baseline sampling can establish observable changes, but never guarantees capture of every intervening write.

Timestamps differ in meaning across filesystems, drivers and operating systems.

Constraints and evidence boundaries

Integrity depends on stable identifiers, clock context, error handling and tamper-evident outputs.

Areas of work

  • SHA-256/BLAKE3 design
  • Drive enumeration
  • SQLite change history

Working approach

The relevant work is evaluated through documented assumptions, source lineage, an explicit scope of responsibility and reproducible checks. A project description is not a substitute for a live demonstration or independent security review. Future public releases should carry dated change notes, methods and a clear license.

Project status and external access

This page describes the project scope and research direction; it does not certify that every proposed feature is live. Public source repository and build artifacts are not linked until a verified repository address is configured.

Source and revision record

Original editorial analysis and definitions. For background reference, consult the source catalog.

Published in this site build: 2026-10-28. · Editorial and correction policy