List registered disk images (name, path, label, timezone) and the default timezone.

Register a disk image (raw, split raw .001, E01) under a short name. Allowed only for paths under the configured allowed_roots (or with FEA_UNRESTRICTED=1); otherwise register on the host with fea images add.

Platform, Python version, optional native tools (sleuthkit, exiftool) and the host access policy in force.

Partition table (mmls-style) with file-system type probing for each partition.

List a directory (path or 'inode:N'): names, inodes, sizes, MAC times, deleted flags, alternate data streams.

Full metadata for a file/dir by path or inode ('inode:N' or 'N-128-3'): times, attributes/ADS, NTFS $FILE_NAME times with a timestomp indicator, istat text when sleuthkit is installed.

Read up to 4 MiB of a file (or an ADS via stream) as text (auto UTF-16 detection) or hex.

Copy a file (or ADS) out of the image into out_dir (relative to, or inside, the output root); returns size, SHA1, MD5.

Find files by path name (glob with * ? or regex), including deleted names. deleted = any|only|no. Times ISO in image timezone.

File-system timeline (directory walk) between start/end (ISO, image timezone), optionally filtered by path regex. kinds: m a c b.

Background job: recover deleted/orphaned files into out_dir (inside the output root), optionally only paths matching regex. Poll job_result.

Background job: search file CONTENT (UTF-8 and UTF-16LE) of files whose path matches path_regex. Poll job_result.

Background job: scan unallocated space for terms; hits carry file-system block numbers (or blkls offsets when sleuthkit is used). Poll job_result.

Search one file (in-image ref, or local_path to an extracted file such as pagefile.sys) for terms; returns offsets and context.

Printable strings (ASCII and UTF-16LE) from a file with offsets, optionally filtered by regex.

Raw bytes at an absolute byte offset in the image (hex dump or text).

Read file-system blocks by number (follow up grep_unallocated hits).

Map a blkls stream byte offset (from a sleuthkit-mode grep_unallocated hit) to the real file-system block.

Read a Windows registry hive (SYSTEM, SOFTWARE, SAM, NTUSER.DAT, UsrClass.dat, Amcache.hve): a key's values, last-write time and subkeys to depth (max 4).

Run regipy artefact plugins on a hive (UserAssist, ShellBags, WordWheelQuery, TypedPaths, USBSTOR, services, ComputerName, timezone, ...).

Query a Windows .evtx log: filter by event IDs, time range (ISO, image timezone), provider, or text; returns flattened event data.

Tables, row counts, columns and freelist size of a SQLite database (browser history, chat apps, Android apps). WAL applied when present.

Run a read-only SELECT against a SQLite database inside the image.

Parse a Windows shortcut (.lnk / Jump List entry): target path, volume serial, machine id, target times.

Parse a Windows Prefetch (.pf) file: executable, run count, last 8 run times, volumes, referenced files.

List tables of an ESE database (SRUDB.dat, Windows.edb, WebCacheV01.dat, ntds.dit).

Dump rows of an ESE database table (optionally selected columns, filtered by text).

Metadata of a media/document file (exiftool when installed, else Pillow EXIF and OOXML properties).

File type, SHA1/MD5/SHA256, entropy, and bytes after the JPEG/PNG/PDF end marker (hidden appended data).

Open an OOXML document (docx/xlsx/pptx): list parts, extract text, comments, properties; flag hidden text and tracked changes.

Scan a file with YARA rules (rule text, or a .yar path inside the allowed roots).

Status and progress of a background job.

Wait up to wait_s seconds (max 300) for a background job and return its result when done.

Ask a running background job to stop at its next progress checkpoint.

List background jobs started in this session.