This tool can parse Ext4 volume image files and Ext4 journal data files.
The input file should be extracted using another tool such as dd, EnCase, or WinHex.
To view "Full Path" information, you must provide an Ext4 volume image file.
By default, time information is displayed in local system time.
Supported File/Directory Events
File/Directory Creation(incuding Initial File Size)
File/Directory Renaming
File/Directory Move
File/Directory Deletion
File Modification
File Access
File/Directory Mode Change
File/Directory Attribute Change
File/Directory Timestamp Manipulation
Xattr Creation/Change/Deletion
Symbolic Link Creation/Change/Deletion
User Interface
Update History
v1.0 (2026.05.08)
Initial version
Created by Junghoon Oh(blueangel)
Email : blueangel1275@gmail.com