OSINT Toolbox vs DFIR Toolkit

From the developer of the award-winning Network Toolbox comes a new standard for open-source intelligence on Apple platforms. OSINT — Open-Source Intelligence — is the practice of gathering and analysing information from publicly available sources: domain registrations, DNS records, IP reputation databases, breach data, certificate logs, and more. OSINT Toolbox makes these capabilities available natively on iPhone, iPad, and Mac — with no accounts, no data collection, and no active probing of target systems. REPLACE A DOZEN BROWSER TABS WITH ONE APP Security researchers, journalists, IT professionals, and privacy-conscious investigators have long relied on a patchwork of web tools — each requiring a separate account, each handling your data differently, many operating opaquely. OSINT Toolbox consolidates the most important of these into a single, transparent, and consistent interface that works the same on every Apple device. INTELLIGENCE MODULES Enter any indicator — domain, IP address, email address, URL, file hash, ASN, phone number, username, or company name — and OSINT Toolbox automatically runs every relevant module in parallel. Results stream in live. Discovered entities can pivot automatically into new investigation threads. Built-in intelligence sources include: • DNS resolution and reverse DNS • RDAP and WHOIS registration data • Certificate transparency logs • VirusTotal, Shodan, AbuseIPDB, GreyNoise • HaveIBeenPwned, ThreatFox, MalwareBazaar • Gravatar, LinkedIn, social account presence • BGP routing, ASN info, IP geolocation • And more — with new modules added regularly Bring your own API keys for services that support it. Free modules work without any key at all. APPLE INTELLIGENCE BUILT IN OSINT Toolbox integrates Apple's on-device AI so you can describe an investigation in plain language — no need to know which modules to pick or how to format the input. Just type what you're looking for: "Check if cloudflare.com has been flagged for malware and show its DNS records and registration details" The app understands your intent, selects the right indicator type, and activates the relevant modules — entirely on-device, privately, with no data sent to any cloud service. The feature is optional and requires a device with Apple Intelligence enabled. INVESTIGATION UTILITIES A growing catalog of standalone utilities covers hashing, encoding, network calculations, DNS lookups, IP geolocation, certificate inspection, JWT decoding, CIDR calculation, URL analysis, mail header analysis, and more — all available offline, all on-device. PRIVACY BY DESIGN OSINT Toolbox is built on a strict principle: your investigation data belongs to you. • No account required • Passive only — never touches target infrastructure; queries public APIs and open data sources only • No analytics, no telemetry, no crash reporting to third parties • App Store privacy label: Data Not Collected • API keys stored exclusively in iCloud Keychain — never logged, never exported, never sent anywhere except the one service they authenticate against • All DNS queries routed through DNS-over-HTTPS • Indicator values never written to logs • No third-party SDKs or libraries of any kind NATIVE. EVERYWHERE. OSINT Toolbox is a Universal Purchase — buy once, use on all your iPhone, iPad, and Mac devices. Written entirely in Swift 6 with SwiftUI. No Electron shell. No web wrapper. No third-party frameworks. Just native Apple technology, done properly. Scan results, investigation notebooks, and settings sync automatically across all your devices via iCloud. API keys sync securely via iCloud Keychain.

Built by a court-qualified forensic examiner: chain-of-custody and consent-to-search documentation you can complete, sign, and export at the scene — fully offline, encrypted on device, no account, no cloud. Everything runs on-device. Look up an artifact location at a scene, convert a FILETIME value on a flight, or document a matter in a facility with no signal — the toolkit works the same everywhere. DOCUMENTATION • Evidence Forms — chain-of-custody and consent-to-search documentation with on-device signature capture. A completed form locks; corrections create a new version instead of overwriting the record. • Case Workspace — organize matters, evidence items, and notes in an encrypted, on-device workspace. • Exports — PDF and JSON generated locally, with a clear disclaimer. Deterministic: the same case produces the same bytes every time. REFERENCE • Artifact Reference — where forensic artifacts live across the operating systems you encounter in the field, with what each one does and does not establish. • File Signature Database — identify files by their magic bytes; search by hex, extension, or type, with a hex quick-view. • Calculators — timestamp (Unix epoch, FILETIME, WebKit, Cocoa, GPS), storage-size, hash, and base conversions, each validated against a published test-vector suite. • Dashboard — resume recent work and pin the tools you use most. BUILT FOR THE WITNESS STAND DFIR Toolkit never touches your evidence. It does not acquire, image, parse, or analyze data, and it produces no findings or opinions — so nothing in it can be attacked as an unvalidated analytical tool, and nothing you do here can alter a working copy. It documents your process and answers your lookups; your validated tools and your judgment do the examination. PRIVATE AND OFFLINE BY DESIGN • No data collection — the app declares "Data Not Collected." • No account, and no network connection required for any feature. • Case data and captured signatures are encrypted at rest on your device. • Full Dynamic Type and VoiceOver support; dark mode throughout. FREE AND PRO The reference side is free: the File Signature Database, all four calculators, the iOS artifact reference, and the Dashboard. DFIR Toolkit Pro unlocks the documentation side — Evidence Forms, Case Workspace, deterministic PDF and JSON exports, and the complete artifact library. DFIR Toolkit Pro is an auto-renewable subscription: 1 year, $119.00 (USD). Payment is charged to your Apple Account at confirmation of purchase. The subscription renews automatically unless it is canceled at least 24 hours before the end of the current period. Manage or cancel anytime in your Apple Account settings. Privacy Policy: https://thewaldrepcompany.com/privacy-policy/ Terms of Use (EULA): https://www.apple.com/legal/internet-services/itunes/dev/stdeula/ ABOUT DFIR Toolkit is built by The Waldrep Company, an Alabama digital forensics practice. It was written by a working, court-qualified examiner to be the reference he wanted in the field: fast, offline, and defensible. Questions, corrections, or an artifact we should add: thewaldrepcompany.com