Daylight
Daylight
Daylight is a fast, cross-platform DFIR platform for incident responders and examiners — a modern alternative to Autopsy and EnCase, with native threat-intel correlation and court-admissible chain-of-custody reporting.
From mounting the evidence to handing the report to a lawyer — without stitching together six utilities.
Raw/DD, EnCase E01, and VMDK images, auto-detected — plus attached physical drives (read-only, with a write-blocker reminder) and mounted folders.
NTFS, FAT, exFAT, ext2/3/4, HFS+, and APFS via The Sleuth Kit, with lazy navigation that stays fast on terabyte images. Full MAC(b) timestamps and deleted-entry detection.
Prefetch (incl. Win10 decompression), LNK, registry, event logs, shellbags, browser history, Amcache, Shimcache, and Jump Lists — extracted into a searchable case database.
Every artifact timestamp on one timeline, and SQLite FTS5 full-text search across everything extracted. Find the pivot point in seconds.
IOC feeds with auto-flagging, plus AlienVault OTX, VirusTotal, and MalwareBazaar lookups — correlation built in, not bolted on.
Branded HTML/PDF reports, a CMMC incident-evidence package, and tamper-evident chain of custody with an integrity digest.
Or click ⚡ Run Full Analysis on the dashboard and let it run extract → IOC scan → report in one pass.
Open a disk image, attach a physical drive read-only, or point at a mounted folder. Format detection is automatic.
Pull artifacts, hash files in one pass, carve by signature, and recover deleted files — all on background threads.
Work the unified timeline, search everything with FTS5, and let IOC feeds and OTX/VT/MalwareBazaar flag what's hostile.
Generate branded HTML/PDF reports or a CMMC evidence package, with tamper-evident chain of custody.
EnCase budgets belong to governments and big-four firms. The work doesn't.
Triage a compromised machine fast: one-click full analysis, IOC auto-flagging, and a timeline that shows you the story.
Defensible methodology: read-only acquisition paths, one-pass hashing, deleted-entry detection, and chain of custody with an integrity digest.
Serve defense and SMB clients with real forensics capability — including CMMC incident-evidence packages — without a six-figure tool budget.
Cross-platform, with a built-in tutorial on first run. Email us for the download — you'll hear back from the person who built it.