AIFT automates Windows and Linux forensic triage analysis of disk images using AI. Upload an E01, VMDK, VHD, raw image, or archive, select which artifacts to parse, and receive an AI-generated forensic report — all from a local web interface, with no external services required. AIFT automatically detects the OS type and presents the appropriate artifact set. Built for incident responders who need fast answers, and simple enough for non-forensic team members to operate.

New to AIFT? Start here:

1. Installation — Install Python dependencies and configure your environment.
2. Getting Started: Your First Analysis — Walk through uploading evidence, selecting artifacts, and generating your first report.

You will also need to configure an AI provider. See AI Provider Setup for instructions on connecting Claude, OpenAI, Kimi, or a local model via Ollama/LM Studio.

Auto-generated code reference documentation is available at:

Code Reference (API Docs)

This wiki documents AIFT as of version 1.3.