Back to Downloads

Atlant Scalpel

v1.0.0WindowsFree

Building a forensic timeline usually means wrestling a pipeline of parsers and glue scripts before you can even start looking. Atlant Scalpel reconstructs a precise, path-resolved timeline from an NTFS volume's $MFT and $UsnJrnl in seconds, then lets you scope it down visually and export the exact slice that matters. Drag across an activity histogram or type a UTC window, layer on extension, path, and filename filters, and export the complete matching set, never a truncated preview, straight into Timeline Explorer, plaso, or The Sleuth Kit.

Download Free (3.2 MB)Windows - 64-bit architecture - No account needed
Atlant Scalpel screenshot 1
Atlant Scalpel screenshot 2
Atlant Scalpel screenshot 3

Download Atlant Scalpel

3.2 MB - Windows - Free - No account required

Download Now

System Requirements

  • Windows 10 or Windows 11
  • 64-bit architecture
  • Administrator privileges for live-volume and shadow-copy access (auto-elevates)
  • No install and no runtime to manage (self-contained)

Release Notes

v1.0.02026-06-25
  • Correlated $MFT and $UsnJrnl timeline reconstruction with path resolution
  • Sources: live volumes, VHDX/VHD/VMDK/raw images, VSS snapshots, and extracted artifacts
  • Event-density histogram with drag-to-select windowing and precision filters
  • Built-in anomaly detection for timestamp tampering and MFT slot reuse
  • Exports to Timeline Explorer, plaso/log2timeline, and The Sleuth Kit mactime
  • Verified full-fidelity binary slice export