Find the personal information in databases and logs - offline, with the evidence left untouched. Forensic Offline scans SQLite databases, JSONL and JSON files for personal and system information, including records that were deleted.
An app's database copied off a laptop, a folder of exported logs, a backup nobody has looked at in years - what personal information is in there, and where? Add the files or whole folders, press Start scan, and Forensic Offline reads every table, row and line on your own PC. It lists each ID number, email address, phone number, account number, computer name, password and key it finds, with where it found it - including records that were deleted but are still in the database's free space. The files themselves are never changed: each one is hashed before and after, and databases are copied before they're opened.
The real app showing a report of made-up sample data: a test employee database and an event log written for the purpose. Values are masked, as they are by default. The copy in the picture is on its 14-day free trial, hence the line at the top. Click the picture to zoom in.
South African ID numbers (with their date and check digit validated), email addresses, phone numbers, addresses, names, bank account and card numbers, and the POPIA special personal information that columns and fields are named for - health, religion, biometrics and the like.
Computer names, usernames, IP and MAC addresses, Windows SIDs, user folders and network paths, internal domain names - and the passwords, tokens and private keys that end up in logs and settings.
A deleted row often stays in a SQLite database's free space, and older versions sit in its -wal and -journal files. Forensic Offline reads those too and marks what it recovered as carved, apart from the live data.
Every file is hashed (MD5 and SHA-256) before and after the scan, and a changed hash is flagged. Databases are copied before SQLite opens them. A file another program has open is skipped with a note, and the scan carries on.
Values are masked in the app and in the reports. Reveal values shows them in full only after it asks, with a warning that the reports then hold personal information - and it's switched off again every time Forensic Offline starts.
Totals by category, a risk rating for each file, and every unique value in a list you can filter and sort. Select a value to see each place it was found. Earlier report folders open here too.
Tell it your computer-name prefixes and internal domains, values and patterns to ignore, detections to switch off and patterns of your own - then try the rules on pasted text before you scan.
--scan a file or folder with the same options as the window, from a script or a scheduled task, with clear exit codes. --self-test checks the scanner on built-in fake data.
Scanning never uses the internet, and nothing it reads leaves your PC. Only the licence check and the update check go online.
Each value is found by a pattern, checked where it can be (a check digit, a card number's checksum, an IBAN), or flagged because of the field it sits in - and rated High, Medium or Low.
Every scan writes its own folder, so a case keeps its reports together - even a cancelled scan writes what it found so far.
Try every feature free for 14 days, then pick the plan that suits you. Prices are in Rand, with the US dollar equivalent as a guide; checkout is PayFast's secure payment page.
Pay a year at a time, cancel whenever you like
Pay once, yours for good
Each licence is for one PC. Need Forensic Offline on several PCs? Talk to us.
Download the setup and run it: Forensic Offline installs in under a minute, with a Start menu entry and, if you like, a desktop icon. Every feature is on for 14 days once you confirm the email you downloaded it with, no card needed. When you buy, we email your licence key; paste it into Forensic Offline's Licence page and you're done. If the trial ends before you buy, new scans stop until it's licensed - earlier reports still open. Uninstalling keeps your settings, rules and reports.
Download Forensic Offline 1.2.1ForensicOfflineSetup-1.2.1.exe - 45.8 MB - Windows 10/11, 64-bit
No. The scan runs entirely on your PC and nothing it reads is sent anywhere. Forensic Offline only goes online to check its licence and to look for updates.
No. Each file is hashed with MD5 and SHA-256 before and after the scan, and the report says whether the hashes still match. SQLite databases are copied to a temporary folder before SQLite opens them, and the copies are deleted afterwards.
It finds what its rules recognise: patterns, checks such as check digits, and field and column names. It isn't AI - a name in free text is found only in a field meant for names, a column simply called "name" is flagged Low for you to check, and recovered deleted data can be in pieces. Treat the results as leads for an examiner to confirm.
No. Forensic Offline reports what it finds and where; it isn't legal advice. What a finding means for you under POPIA or any other law is for you and your advisers to decide.
Another program had it open - a browser's history, Teams or Outlook, say. Close that program, or scan a copy (a Volume Shadow Copy, for example). The rest of the scan carries on either way.
Anyone who opens them, so values are masked by default. If you tick Reveal values, the reports hold the full values - personal information to be handled as confidential. Reveal is never remembered between runs.
Yearly costs R588 a year (R49 a month) and renews until you cancel. Lifetime is R999 once and never renews. If you'll use Forensic Offline for more than about two years, Lifetime costs less.
Sign in to your StreamSoft account and choose Cancel subscription on the order. Forensic Offline stays fully on until the year you've paid for ends, and you won't be charged again.
One. Moving to a new PC? Choose Deactivate on this PC on Forensic Offline's Licence page, then activate it on the new one - or ask us to free the licence. For several PCs, get in touch.
Checkout is PayFast's secure page, so we never see your card details. We email your licence key once the payment has gone through.
Fourteen days free with everything on - then R49 a month billed yearly, or R999 once.
Start your free trial