Back to Downloads

Atlant Scalpel

v1.1.0WindowsFree
4Source Types
3Export Formats
2NTFS Artifacts
13Features
1Portable EXE
100%Free

Every other timeline tool makes you choose: binary carvers filter by structure but ignore time, while timeline tools filter by time but only emit text. Atlant Scalpel does both. Point it at a live C:, a disk image, or a VSS shadow copy, scope an exact UTC window (or drag across an activity histogram), and layer file-type, path, and filename filters - now compounding them into AND clauses.

Download Free (65.3 MB)Windows - Administrator privileges for live-volume and VSS shadow-copy access (self-elevates); file-based sources need no elevation - No account needed
Atlant Scalpel screenshot 1
Atlant Scalpel screenshot 2
Atlant Scalpel screenshot 3

Overview

Then cut a compact, re-parse-verified binary $MFT and $J slice, a fraction of the source size that opens unmodified in MFTECmd, analyzeMFT, or The Sleuth Kit, with a JSON chain-of-custody manifest. Or export MFTECmd CSV, TSK bodyfile, or log2timeline l2t_csv for Timeline Explorer and plaso.

Features

Time-windowed binary slicing: filter $MFT and $J by a UTC time window and carve a valid binary artifact, not just CSV rows
Compound AND filters: stack include/exclude clauses (for example, under \Windows AND not under \Windows\Temp) that drive the grid and every export
Loads live volumes, disk images (raw/dd, VHD, VHDX, VMDK), VSS shadow copies, or extracted $MFT/$J artifacts
Built-in sample volume to explore every feature with zero setup
Three correlated views: MFT (with $SI MACB timestamps), USN change journal, and a path-resolved enriched timeline
Event-density histogram with drag-to-select windowing and a smart first-of-month to now default
Filter by file type (Include or Exclude), path prefix, and filename, with a one-click Executables preset
Automatic anomaly flags for timestomping ($SI < $FN), zeroed sub-seconds, and reused MFT slots (SeqMatch)
Compact, renumbered, re-parse-verified binary $MFT + $J slice with a slice.manifest.json chain-of-custody sidecar
Exports: binary slice, MFTECmd-compatible MFT CSV, USN CSV, enriched CSV, TSK bodyfile, and log2timeline l2t_csv
Read-only on sources, nothing unpacked to %TEMP%, SHA-256 integrity manifest in the package
Scriptable CLI (scalpel: slice, csv, vss) over the same engine, with meaningful exit codes
Single self-contained executable, no installer or .NET runtime, self-elevates for raw device sources

Download Atlant Scalpel

65.3 MB - Windows - Free - No account required

Download Now

System Requirements

  • Windows 10 or Windows 11, 64-bit
  • Administrator privileges for live-volume and VSS shadow-copy access (self-elevates); file-based sources need no elevation
  • No installation and no .NET runtime to manage (self-contained)

Release Notes

v1.1.02026-06-30
  • Compound AND filters: freeze File Types, Paths, and Filename into stackable, removable clauses that drive the grid, the binary slice, and every export identically
  • Self-contained single-executable build (no .NET runtime to install); nothing unpacked to %TEMP% at launch
  • Smart default time window on load (first of the current month to now) for faster live triage
  • slice.manifest.json chain-of-custody sidecar plus SHA256SUMS integrity manifest in the package
  • Refined WPF Fluent UI with OS-following light and dark theme
  • Scriptable CLI (slice, csv, vss) with key=value output and meaningful exit codes
v1.0.02026-06-25
  • Correlated $MFT and $UsnJrnl timeline reconstruction with path resolution
  • Sources: live volumes, VHDX/VHD/VMDK/raw images, VSS snapshots, and extracted artifacts
  • Event-density histogram with drag-to-select windowing and precision filters
  • Built-in anomaly detection for timestamp tampering and MFT slot reuse
  • Exports to Timeline Explorer, plaso/log2timeline, and The Sleuth Kit mactime
  • Verified full-fidelity binary slice export