A forensic disk wipe detection framework designed to analyze disk images for possible wiping, high-entropy overwrite regions, SSD TRIM behavior, multi-pass wipe patterns, and evidence integrity verification.
The project combines a high-performance Rust analysis engine with a Python FastAPI layer for API-based execution and HTML report generation.
- Disk image scanning using block-wise analysis
- SHA-256 hash verification before analysis
- Entropy-based wipe pattern detection
- Multi-pass overwrite pattern analysis
- SSD TRIM candidate detection
- E01 image handling support
- JSON output from Rust core
- FastAPI endpoint for analysis
- HTML forensic report generation
- Docker-based deployment support
- Rust
- Python
- FastAPI
- Pydantic
- Jinja2
- Streamlit
- Docker
- Docker Compose
wipe_detector_framework/
├── config/
│ └── config.yaml
├── docker/
│ ├── docker-compose.yml
│ ├── python.Dockerfile
│ └── rust.Dockerfile
├── python-api/
│ ├── app.py
│ ├── requirements.txt
│ ├── services/
│ ├── templates/
│ └── ui/
└── rust-core/
├── Cargo.toml
└── src/
- The user provides a disk image path and expected SHA-256 hash.
- The Rust core verifies the disk image integrity.
- If the hash matches, the disk image is scanned block by block.
- The scanner detects wipe-like patterns using entropy and repetition thresholds.
- Additional modules perform multi-pass analysis, encryption-region detection, and SSD TRIM candidate detection.
- Results are scored and exported as JSON.
- The Python FastAPI service converts the analysis output into an HTML forensic report.
The framework uses config/config.yaml
block_size: 4096
entropy_random_threshold: 7.8
single_byte_threshold: 0.95
ssd_page_size: 4096{
"image_path": "sample.raw",
"expected_sha256": "your_expected_sha256_hash",
"case_info": {
"case_id": "CASE-001",
"case_title": "Suspected Disk Wipe Investigation"
},
"investigator_info": {
"name": "Investigator Name",
"organization": "Cyber Forensic Lab"
}
}{
"report_html": "<html>Generated forensic report</html>"
}git clone git@github.com:code-with-nc/wipe_detector_framework.git
cd wipe_detector_frameworkcd rust-core
cargo build --release
cd ..cd python-api
pip install -r requirements.txtuvicorn app:app --host 0.0.0.0 --port 8000API will run at:
http://localhost:8000
cd docker
docker compose up --build./rust-core/target/release/wipe_detector_core sample.raw <expected_sha256>The Rust engine outputs structured JSON containing:
- scanned block results
- detected wipe patterns
- entropy values
- multi-pass analysis results
- encryption-region indicators
- SSD TRIM candidates
- severity scores
- audit log SHA-256 hash
- Digital forensic disk investigation
- Evidence integrity validation
- Deleted/wiped data analysis
- SSD wipe behavior detection
- Cyber crime lab training
- Academic forensic research
- Incident response investigation workflow
This tool is intended for educational, research, and authorized forensic investigation use only.
Always work on forensic copies of disk images and preserve original evidence according to chain-of-custody procedures.
Narayani
GitHub: code-with-nc