FREE SECURITY SOFTWARE

Atlant Scalpel

v1.1.0WindowsFree

Find the files that matter.

Scope a precise time window, filter forensic artifacts and export the evidence you need.

Download Free (65.3 MB)Windows - Administrator privileges for live-volume and VSS shadow-copy access (self-elevates); file-based sources need no elevation - No account needed

Atlant ScalpelPRODUCT PREVIEW

4Source Types

3Export Formats

2NTFS Artifacts

13Features

1Portable EXE

100%Free

01 / TOOL DETAILS

Overview

Then cut a compact, re-parse-verified binary $MFT and $J slice, a fraction of the source size that opens unmodified in MFTECmd, analyzeMFT, or The Sleuth Kit, with a JSON chain-of-custody manifest. Or export MFTECmd CSV, TSK bodyfile, or log2timeline l2t_csv for Timeline Explorer and plaso.

Every other timeline tool makes you choose: binary carvers filter by structure but ignore time, while timeline tools filter by time but only emit text. Atlant Scalpel does both. Point it at a live C:, a disk image, or a VSS shadow copy, scope an exact UTC window (or drag across an activity histogram), and layer file-type, path, and filename filters - now compounding them into AND clauses.

INSIDE THE SOFTWARE

See how it works.

03 / TOOL DETAILS

Features

Time-windowed binary slicing: filter $MFT and $J by a UTC time window and carve a valid binary artifact, not just CSV rows

Compound AND filters: stack include/exclude clauses (for example, under \Windows AND not under \Windows\Temp) that drive the grid and every export

Loads live volumes, disk images (raw/dd, VHD, VHDX, VMDK), VSS shadow copies, or extracted $MFT/$J artifacts

Built-in sample volume to explore every feature with zero setup

Three correlated views: MFT (with $SI MACB timestamps), USN change journal, and a path-resolved enriched timeline

Event-density histogram with drag-to-select windowing and a smart first-of-month to now default

Filter by file type (Include or Exclude), path prefix, and filename, with a one-click Executables preset

Automatic anomaly flags for timestomping ($SI < $FN), zeroed sub-seconds, and reused MFT slots (SeqMatch)

Compact, renumbered, re-parse-verified binary $MFT + $J slice with a slice.manifest.json chain-of-custody sidecar

Exports: binary slice, MFTECmd-compatible MFT CSV, USN CSV, enriched CSV, TSK bodyfile, and log2timeline l2t_csv

Read-only on sources, nothing unpacked to %TEMP%, SHA-256 integrity manifest in the package

Scriptable CLI (scalpel: slice, csv, vss) over the same engine, with meaningful exit codes

Single self-contained executable, no installer or .NET runtime, self-elevates for raw device sources

Download Atlant Scalpel

65.3 MB - Windows - Free - No account required

Download Now

System Requirements

Windows 10 or Windows 11, 64-bit
Administrator privileges for live-volume and VSS shadow-copy access (self-elevates); file-based sources need no elevation
No installation and no .NET runtime to manage (self-contained)

Release Notes

v1.1.02026-06-30

Compound AND filters: freeze File Types, Paths, and Filename into stackable, removable clauses that drive the grid, the binary slice, and every export identically
Self-contained single-executable build (no .NET runtime to install); nothing unpacked to %TEMP% at launch
Smart default time window on load (first of the current month to now) for faster live triage
slice.manifest.json chain-of-custody sidecar plus SHA256SUMS integrity manifest in the package
Refined WPF Fluent UI with OS-following light and dark theme
Scriptable CLI (slice, csv, vss) with key=value output and meaningful exit codes

v1.0.02026-06-25

Correlated $MFT and $UsnJrnl timeline reconstruction with path resolution
Sources: live volumes, VHDX/VHD/VMDK/raw images, VSS snapshots, and extracted artifacts
Event-density histogram with drag-to-select windowing and precision filters
Built-in anomaly detection for timestamp tampering and MFT slot reuse
Exports to Timeline Explorer, plaso/log2timeline, and The Sleuth Kit mactime
Verified full-fidelity binary slice export