# DFIR Toolkit — Forensic reference & case docs > Offline forensic documentation and reference toolkit for digital investigators. (iPhone/iPad app by The Waldrep Company.) - Source: https://appshunter.io/ios/app/dfir-toolkit/id6793640596 (this page in markdown: same URL + `.md`) - Developer: [The Waldrep Company](https://appshunter.io/developer/6793640598) - Category: Utilities, Reference - Price: Free with in-app purchases - Rating: 5.00/5 from 1 App Store ratings - Age rating: 4+ - Requires: iOS 17.0 · 11 MB - Languages: American English - Released: 2026-08-17 - Data updated: 2026-09-30 - Monetization: freemium - User reviews in markdown: https://appshunter.io/ios/app/dfir-toolkit/id6793640596/reviews.md ## What is DFIR Toolkit? Built by a court-qualified forensic examiner: chain-of-custody and consent-to-search documentation you can complete, sign, and export at the scene — fully offline, encrypted on device, no account, no cloud. Everything runs on-device. Look up an artifact location at a scene, convert a FILETIME value on a flight, or document a matter in a facility with no signal — the toolkit works the same everywhere. DOCUMENTATION • Evidence Forms — chain-of-custody and consent-to-search documentation with on-device signature capture. A completed form locks; corrections create a new version instead of overwriting the record. • Case Workspace — organize matters, evidence items, and notes in an encrypted, on-device workspace. • Exports — PDF and JSON generated locally, with a clear disclaimer. Deterministic: the same case produces the same bytes every time. REFERENCE • Artifact Reference — where forensic artifacts live across the operating systems you encounter in the field, with what each one does and does not establish. • File Signature Database — identify files by their magic bytes; search by hex, extension, or type, with a hex quick-view. • Calculators — timestamp (Unix epoch, FILETIME, WebKit, Cocoa, GPS), storage-size, hash, and base conversions, each validated against a published test-vector suite. • Dashboard — resume recent work and pin the tools you use most. BUILT FOR THE WITNESS STAND DFIR Toolkit never touches your evidence. It does not acquire, image, parse, or analyze data, and it produces no findings or opinions — so nothing in it can be attacked as an unvalidated analytical tool, and nothing you do here can alter a working copy. It documents your process and answers your lookups; your validated tools and your judgment do the examination. PRIVATE AND OFFLINE BY DESIGN • No data collection — the app declares "Data Not Collected." • No account, and no network connection required for any feature. • Case data and captured signatures are encrypted at rest on your device. • Full Dynamic Type and VoiceOver support; dark mode throughout. FREE AND PRO The reference side is free: the File Signature Database, all four calculators, the iOS artifact reference, and the Dashboard. DFIR Toolkit Pro unlocks the documentation side — Evidence Forms, Case Workspace, deterministic PDF and JSON exports, and the complete artifact library. DFIR Toolkit Pro is an auto-renewable subscription: 1 year, $119.00 (USD). Payment is charged to your Apple Account at confirmation of purchase. The subscription renews automatically unless it is canceled at least 24 hours before the end of the current period. Manage or cancel anytime in your Apple Account settings. Privacy Policy: https://thewaldrepcompany.com/privacy-policy/ Terms of Use (EULA): https://www.apple.com/legal/internet-services/itunes/dev/stdeula/ ABOUT DFIR Toolkit is built by The Waldrep Company, an Alabama digital forensics practice. It was written by a working, court-qualified examiner to be the reference he wanted in the field: fast, offline, and defensible. Questions, corrections, or an artifact we should add: thewaldrepcompany.com ## Key features - Chain-of-custody documentation - Consent-to-search forms - On-device signature capture - Encrypted case workspace - Artifact reference library - File signature database - Timestamp and storage calculators ## Pricing and in-app purchases Base price: Free. **Subscriptions** | Subscription | Price | Period | | --- | --- | --- | | DFIR Toolkit Pro | $119.00 | per year | ## Frequently asked questions about DFIR Toolkit ### What is DFIR Toolkit? DFIR Toolkit is a mobile application designed for digital forensic examiners. It offers tools for creating chain-of-custody and consent-to-search documentation, organizing case files, and accessing a reference library of forensic artifacts and file signatures. The app operates fully offline and encrypts all data on the device. ### Is DFIR Toolkit free to use? The reference features of DFIR Toolkit, including the File Signature Database, calculators, iOS artifact reference, and Dashboard, are available for free. The documentation features, such as Evidence Forms and Case Workspace, require a subscription to DFIR Toolkit Pro. ### How much does DFIR Toolkit Pro cost? DFIR Toolkit Pro is an auto-renewable subscription priced at $119.00 USD per year. Payment is processed through your Apple Account upon purchase confirmation. You can manage or cancel your subscription at any time within your Apple Account settings. ### Does DFIR Toolkit collect any user data? No, DFIR Toolkit is designed with privacy as a core principle and declares "Data Not Collected." It does not collect any user data, require an account, or need a network connection for any of its features. All case data and captured signatures are encrypted at rest on your device. ### Can DFIR Toolkit be used offline? Yes, DFIR Toolkit is built for offline use. All features, including documentation, reference lookups, and calculations, run entirely on the device. This allows examiners to use the toolkit effectively in environments with no signal or internet access. ### What devices does DFIR Toolkit support? DFIR Toolkit is available for iPhone and iPad devices. It supports Dynamic Type and VoiceOver, and features a dark mode for enhanced usability across Apple's mobile ecosystem. ### How often is DFIR Toolkit updated? DFIR Toolkit was last updated on August 18, 2026, with version 1.0. The release date was August 17, 2026. Specific update frequency is not detailed, but it is developed by The Waldrep Company, a digital forensics practice. ### What kind of documentation can I create with DFIR Toolkit Pro? DFIR Toolkit Pro allows you to create and complete chain-of-custody and consent-to-search documentation directly on your device. Completed forms are locked to prevent overwriting, with corrections creating new versions. The app also supports deterministic PDF and JSON exports. ## Version history (last 1 release) ### 1.0 — 2026-08-18 No release notes. ## Apps similar to DFIR Toolkit | App | Rating | Price | Category | | --- | --- | --- | --- | | [OSINT Toolbox](https://appshunter.io/ios/app/osint-toolbox/id6765688833) | — | $14.99 | Utilities | | [CORE by Badge Apps](https://appshunter.io/ios/app/core-by-badge-apps/id6787275498) | — | Free | Utilities | | [ForensAI](https://appshunter.io/ios/app/forensai/id6754491618) | 5.0 (1) | Free | Utilities | | [Network Analyzer Scanner Netty](https://appshunter.io/ios/app/network-analyzer-scanner-netty/id955075829) | 4.2 (207) | Free | Utilities | | [BSSID SCAN](https://appshunter.io/ios/app/bssid-scan/id1442586100) | 2.8 (4) | Free | Utilities | | [QuietMe - Call Blocker](https://appshunter.io/ios/app/quietme-call-blocker/id6535681108) | 4.0 (6) | Free | Utilities | --- *Data collected daily from the US App Store and indexed by [AppsHunter](https://appshunter.io/). User reviews are verbatim App Store reviews. Ratings, prices and chart positions refresh continuously; this snapshot is from 2026-09-30.*