Collectionloom
Portable forensic acquisition toolkit â Disk imaging, RAM capture, write blocker, encryption detection, mobile triage, cloud snapshot, network capture, chain of custody. Tauri v2 + Rust + SvelteKit.
CollectionLoom đ
Portable forensic acquisition tool â evidence collection compliant with ISO 27037, built with Tauri v2 + Rust + SvelteKit.
⨠Features
| Feature | Details |
|---|---|
| Disk Imaging | Sector-by-sector acquisition (E01, dd, split-dd) with SHA-256 verification |
| RAM Capture | Volatile memory acquisition via avml / LiME |
| Mobile Triage | Android/iOS logical and physical acquisition |
| Cloud Snapshot | AWS/Azure/GCP evidence collection with temporary credentials |
| Network Capture | Packet capture via BPF with SPAN/mirror configuration |
| System Snapshot | Point-in-time file/process/network capture |
| Acquire All | Parallel multi-source acquisition with ETA tracking |
| Write Blocker | Hardware & software write protection |
| Chain of Custody | Evidence tracking with Ed25519 signatures |
đĨī¸ Screenshots
| Disk Imaging |
|---|
âšī¸ More screenshots coming soon â some features require the Tauri backend runtime.
đ Quick Start
git clone https://github.com/YSF-Studio/collectionloom.git
cd collectionloom/packages/collectionloom
npm install
npm run tauri dev
Or download the latest release from the Releases page.
đī¸ Tech Stack
- Backend: Rust with Tauri v2
- Frontend: SvelteKit 5
- Hashing: SHA-256 via Rust
sha2crate - Cloud: AWS SDK, Azure SDK, GCP SDK via Rust
- Capture: BPF, avml integration
