Transitioning Forensics Wiki to GitHub

Transitioning Forensics Wiki to GitHub

Copied on 20 November 2022 from with permission. Authored by Simson Garfinkel.

We created the Forensics Wiki so that digital forensics practitioners would have a place where they could record things that they had learned for the benefit of themselves, their co-workers, and the community as a whole.

The Forensics Wiki was modeled on Wikipedia, in that we created it as a non-commercial, space without advertising. But the Forensics Wiki soon developed ground rules that were fundamentally different from Wikipedia.

Unlike Wikipedia, information on the Forensics Wiki does not need to be cited. Because the Forensics Wiki is created and maintained by practitioners, much of the information that the wiki contains is either original information that the authors have learned through the process of reverse engineering, or else it is information they couldn’t attribute to a specific source due to security concerns.

Another difference is content that might be viewed by some to be self-promotional or commercial. While Wikipedia has rules that generally prohibit people from editing articles about themselves or their organizations, we encouraged this on the Forensics Wiki. Our community is so small, so the only way we will have detailed articles about small businesses and most software packages is if they are created by the businesses and authors themselves. Stuff that is obviously incorrect will either be edited or, more likely, ignored.

Because of the small size of the open source digital forensics community, hosting the Forensics Wiki has always been a challenge. It started as a side project by Simson Garfinkel, and was hosted in his Dreamhost account. In 2015 Simson handed the domain and the wiki content to a company that had a contract with the US government to develop a portal for use by forensics practitioners. But that company was acquired by another company soon after the domain was handed over, and the corporate successor was not interested in open source digital forensics. After the organization shut down the servers, we reconstructed the wiki at

We are now transitioning the Forensics Wiki to a new platform once again — a platform that offers new opportunities for growth. We have created an organization on GitHub called ‘forensicswiki’ that will be used for all things related to the wiki. We have translated all of the articles from the MediaWiki markup language to Markdown and imported them to a git repo that is hosted at The pages are then automatically rendered to, where they can be searched using a modern, highly responsive search interface.

We wish to thank Rob Colonna, Ryan Benson and Joachim Metz at Google for their work on this transition.

We will be setting up the domain to forward to the new location. (Unfortunately, we still haven’t been able to recover the and domains from the organization that now owns them.)

Updates to the forensicswiki are now submitted as pull requests to the forensicswiki/wiki git repo. Once they are approved, the articles will go live on the website.

Thanks to everyone who has contributed to the wiki in the past. We look forward to working with you in the future!

See you at


Popular posts from this blog

Parsing the $MFT NTFS metadata file

Incident Response in the Cloud

Container Forensics with Docker Explorer