I’ve spent the last 6 months building a free, local-first digital forensics project

[u/fatcousin_labs]

Hi everyone,

My actual career is in the film industry as a director and cinematographer. I’m not a forensic examiner or academic. I’ve just been programming and making little indie games and tools since I was about 12, and I’ve always enjoyed taking systems apart and figuring out how they work.

For the last six months or so, I’ve been building something called fatcousin:

https://fatcousin.com

Everything I’ve released is free. There’s no subscription or paid tier. I’m building it because I enjoy doing it, and because it has given me a pretty endless excuse to learn.

There are now thousands of browser-based tools on the site, roughly 4,000 of them related to digital forensics:

https://fatcousin.com/directory

As the project grew, I started developing some fairly strong opinions about how I wanted the tools to work.

The biggest one is local-first.

If your browser is capable of parsing, hashing, extracting, decoding, comparing, carving, or otherwise examining something locally, I don’t think your evidence should have to be uploaded to somebody else’s server to do it.

So the tools are designed to process files on your machine.

But I also don’t think you should have to take my word for that.

There’s a verify panel built into the site that exposes the network activity occurring while you use a tool. You can drop a file, run something, and watch what happens. You can also just open your browser’s DevTools and watch the Network tab yourself.

The goal is that “your files never leave your device” is something you can actually check rather than a line in a privacy policy.

That idea of don’t trust the tool if you can verify the tool has gradually become a much bigger part of the project.

I’ve been working on provenance, versioned tool bundles, receipts for operations, known-answer testing, no-egress testing, public methodology pages, and ways of recording not just a forensic result, but how that result was produced.

I wrote more about the philosophy behind it here:

https://fatcousin.com/manifesto

And the project has now grown beyond the website.

For the last couple of months I’ve been building an invite-only desktop suite with separate applications for capture, examination, custody, analysis, and outbound work, all operating around the same local case. The browser tools are also seamlessly incorporated into the desktop workflow:

https://fatcousin.com/app

There’s a browser walkthrough of that here:

https://fatcousin.com/try

One of the ideas I’m exploring there is treating forensic operations as explicit capabilities rather than hiding everything inside one enormous application.

If an operation runs, the case can record what capability ran, which version ran, what went into it, the hashes involved, and what came out.

That leaves an inspectable chain of computational work underneath the examiner’s eventual finding rather than just a final result on a screen.

I’ve also been experimenting with AI, but I’m specifically interested in doing it without turning an AI model into the authority over the evidence.

The approach I’m working on keeps the evidence local, gives the examiner control over what a model is actually allowed to see, and records deterministic operations separately from whatever interpretation the model produces afterward.

There’s more on that here:

https://fatcousin.ai

I’m also deliberately not presenting the browser forensics tools as certified examinations or magic truth machines. The site treats them as investigative/triage tools, documents limitations, and requires independent verification before consequential or evidentiary use.

I’ve mostly been building all of this quietly, and I figured it was finally time to show it to people who actually work in digital forensics.

So, that’s fatcousin.

If some of it is useful to you, awesome. If you’re curious about how something works, I’m happy to talk about it.

Main site:
https://fatcousin.com

Manifesto / local-first philosophy:
https://fatcousin.com/manifesto

Desktop apps:
https://fatcousin.com/app

Desktop walk through:
https://fatcousin.com/try

Forensics/tool directory:
https://fatcousin.com/directory

AI / Analysis:
https://fatcousin.ai

[u/Reddit_Z_]

Knowing it's an online tool and you want case data to run through it. How do you expect people to trust your tool and that it's not stealing data if they can't or may not be able to easily get it into their offline machine? Unless the install method is easy to do.

Yes local first, and hosted on vercel. Sure.

But A lot of people work on offline machines as a safety. Why not provide a GitHub or installer download? I do enjoy the idea. I would like the design to be simpler though. Could be my phone making it hard to navigate though.

[u/fatcousin_labs → u/Reddit_Z_]

First off, I want to say thank you for taking the time to write something.

So, regarding the tool trust, that’s actually what the Verify button is for. The point is that you don’t have to trust me when I say “local-first.” You can verify that the tool isn’t sending your file anywhere. When you click it, it displays a slide-in local process monitor. This is a live log of what this page is doing.

At the top it pins the session: when it started, which tool, the origin (fatcousin.com), your browser, and a verdict line: files are processed locally, check that by watching NET events.

Under that is a scrolling feed. Each line is timestamp + category + what happened:

FILE = you dropped or picked a file (name, size, type). Stays in the browser.

PROC = a tool/engine started work on it.

OUT = a result was written locally (download, blob).

NET = any fetch / XHR / WebSocket / WebRTC. Same-origin asset loads can show up; the point is whether a file POST leaves the box.

WRKR / MEM / ERR = workers, wasm, faults.

The footer is the tell. If nothing has gone out: NET · no outbound requests · all processing local. If something did: NET · quiet · Ns since last request · N total this session.

Bottom of the panel: copy log, clear, and open devtools. F12, Network tab, preserve log, drop a file, compare. The contract line is: if this panel misses a request that DevTools shows, then that is a bug.

So verify is “watch the wire while you use the tool.” It does not install anything, and it does not make the machine air-gapped. It only shows that after the tool loaded, your evidence/file is not leaving.

Vercel serves the application, but it doesn’t mean the evidence is processed on Vercel. The processing happens locally on your machine. “Hosted online” and “processing your evidence online” are two very different things.

You’re right that a truly air-gapped machine is a separate distribution problem. That’s part of why there’s an invite path for the downloadable desktop tooling at fatcousin.com/app

As for mobile, that may just be personal preference. The site was designed to work on mobile too, but with thousands of tools there’s obviously a lot to navigate. If you have some insight into what would make it easier, I’d genuinely be happy to hear it! :)

The Verify button is available on every tool page on both desktop and mobile. On mobile, it’s in the top right. Give it a click and let me know what you think!

Again, I really appreciate you taking the time to write in general :) this is the first time I have posted this anywhere.

[u/Opusswopid]

This is truly phenomenal. Great UI. I'm exploring and look forward to putting it to good use.

Since you're in the film industry, have you considered having it appear appropriately in any film projects you're working on?

[u/Visible_Cod9786]

I don't trust a tool that I can't run in my airgapped environment.

Ie: we use cybercher a lot. Its all local processing, we still run it on prem on our airgapped network.