OpenRelik on Ubuntu 24.04 LTS

Overview

OpenRelik gives a security team a shared workspace for digital forensics and incident response. Investigators create a folder for a case, upload the evidence they have collected, then run processing workflows over it without leaving the browser. The processing itself is done by a pool of independent workers, so a long running job such as building a super timeline from disk and log artefacts runs in the background while the team carries on working, and the results land back in the same case folder for everyone to review. Because folders can be shared, several analysts can work the same incident together instead of passing files and spreadsheets around, and the workflow definitions make the steps taken repeatable and reviewable rather than ad hoc. Out of the box it can extract archives, pull strings from binary artefacts, triage large files by pattern and build timelines, and further workers can be added for other tooling.

Common uses

• Run a shared incident investigation with evidence, workflows and findings in one case folder
• Build super timelines and extract artefacts from collected evidence in the background
• Give an incident response team a repeatable, reviewable forensic processing pipeline

See it running

Real screenshots taken while testing this image against its deployment guide.