Phaneendhar.Nittala

Developer & Forensic Science Graduate

B.Sc. Forensic Science

Centurion University of Technology and Management (Andhra Pradesh)

Loading P.H.A.N.I.X

P.H.A.N.I.X

Phaneendhar's Investigation eXpert

A powerful, professional-grade digital forensics suite for comprehensive evidence analysis. Fast, secure, and entirely client-side.

Project Ecosystem

Explore Specialized Forensic Tools

Use these focused applications for faster case intake, QR evidence workflows, and lab-grade analysis.

P.H.A.N.I.X Lab

Deep analysis environment for complex logs, payloads, and forensic reports

Launch Application

Forensic QR Generator

Generate and manage traceable evidence QR architecture for chain-of-custody.

Launch Application

N.I.T.T.A.L.A v7.4

Node-based Investigative Toolkit for Trace Analysis and Log Auditing

Launch Application

Processing...

Integrity & Threat Scanner

Select File for Deep Analysis

Select a file and click "Full Scan", or switch to URL mode.

Comparing...

File Comparison Tool

Original File

Comparison File

Select two files and click "Compare Files".

Analyzing...

Metadata Analyzer

Select Image/File

Select a file and click "Analyze Metadata".

Scanning...

Steganography Analyzer

Upload Image (PNG recommended)

Channel

Bit Plane

Select an image and click "Analyze Bit Plane".

Analyzing...

Password Audit

Enter Password

Enter a password and click "Full Analysis".

Analyzing...

Advanced Network Log Analyzer

Paste System or Network Logs

IP Watchlist (Optional, comma or newline separated)

Case Notes

Investigator's Notes (auto-saved with case)

Report Generation

Case Name / ID

Investigator Name

Organization Name

Case Type

Courtroom-Ready Mode

Chain of Custody Log

This log is cryptographically secured. All entries are reflected in the final PDF report to ensure a tamper-evident record.

Settings

Light Theme

Disable Background Animation

Default Investigator Name

Default Organization Name

Integrity & Threat Scanner

What It Does

Performs deep forensic analysis of any file â€” computing cryptographic fingerprints, detecting threats heuristically, extracting embedded strings and network indicators, and detecting file-type spoofing. Also includes a URL Integrity inspector for checking suspicious links.

File Scan Mode

Hashes (MD5, SHA-1, SHA-256, SHA-512): Unique fingerprints for the file. Any single-bit change produces a completely different hash â€” the backbone of tamper detection.
Threat Intelligence (Hash + Heuristics): SHA-256 is checked against a known malware database. Heuristic scoring then adds risk points for suspicious PE files, high entropy, and header/extension mismatches.
Header â†” Extension Mismatch: Detects when a file's real magic-byte type (e.g., EXE) doesn't match its extension (e.g., .txt) â€” a classic file disguise technique.
Entropy Analysis: 0=fully ordered, 8.0=fully random. High entropy on a non-compressed file likely means encryption or packing (malware concealment).
Extracted Strings & Artifacts: Scans binary content for printable ASCII strings (â‰¥5 chars), surfacing embedded paths, commands, registry keys, and Base64 blobs â€” all classified by category.
Indicators of Compromise (IoC): Automatically extracts and tags all embedded URLs, IPs, email addresses, and domain names found within the file â€” a critical step in malware triage.
File Carving: Scans for embedded file-type headers (JPEG, PNG, PDF, ZIP, etc.) that may be hidden inside another file.

URL Integrity Check Mode

URL Risk Scoring: Each URL is analyzed for suspicious patterns â€” IP-based hosts, excessive subdomains, lookalike domains, suspicious TLDs, encoded characters, suspicious paths, and more.
Protocol & Structure Analysis: Checks for missing HTTPS, unusually long URLs, and redirect chains in the URL structure.
VirusTotal Link: Provides a one-click link to check the URL directly on VirusTotal for external threat intelligence.

Comparison Tool

What It Does

Performs a deep, byte-by-byte comparison of two files to determine if they are different, and if so, where the differences lie.

How to Interpret the Results

Identical / Different Status: This is based on a cryptographic hash comparison. If the SHA-256 hashes match, the files are 100% identical.
Diff Map: This is a powerful visual tool. It represents the entire file as a grid. Each block in the grid corresponds to a section of the file.
- â– Red blocks indicate that the data in that section is different between the two files.
- â– Faint blocks indicate the data is identical in that section.
This map allows you to see at a glance how much of a file has changed and in what location (e.g., changes only at the beginning, end, or scattered throughout).

Metadata Analyzer

What It Does

Extracts hidden information (metadata) embedded within files, particularly images, videos, and documents.

How to Interpret the Results

Key Forensic Findings: This box highlights the most forensically relevant data points for quick assessment.
GPS Coordinates: If present, this is a critical finding, showing the precise latitude and longitude where a photo or video was taken. The tool displays this on an interactive map.
Timestamp (DateTimeOriginal): This is often the exact date and time a photo was captured, which can be crucial for building a timeline of events.
Software / Device: This can reveal the camera model (e.g., "iPhone 14 Pro") or the software used to create or edit the file (e.g., "Adobe Photoshop"). This helps in attributing the file's origin.

Steganography

What It Does

Looks for data that may be concealed within an image using a common technique called LSB (Least Significant Bit) steganography.

How to Interpret the Results

Bit Plane: An image is made of color channels (Red, Green, Blue, Alpha). Each color's value is a number from 0-255, which is 8 bits of data. This tool isolates a single "bit plane" (e.g., all the 1st bits, or all the 8th bits) across one channel.
Bit Plane Entropy: This is the key indicator. A bit plane from a normal, un-tampered image should have very low, non-random entropy. If the entropy is very high (close to 1.0), it means the data in that plane is highly random. This is a strong sign that encrypted or compressed data has been hidden there.
Visual Preview: The black and white image shows you what the isolated bit plane looks like. A normal plane might show a faint outline of the original image. A plane containing hidden data will often look like random TV static.

Password Audit

What It Does

Measures the objective strength of a password against modern cracking techniques.

How to Interpret the Results

Password Entropy (bits): This is the most important metric. It measures the password's unpredictability. Higher is exponentially better.
- < 40 bits: Very Weak
- 40-60 bits: Weak
- 60-80 bits: Moderate
- 80-100 bits: Strong
- > 100 bits: Very Strong
Estimated Crack Time: This translates entropy into a practical, real-world metric. It's an estimate of how long it would take a powerful cracking rig (capable of billions of guesses per second) to find the password.
Recommendations: The tool provides simple, actionable advice based on what the password lacks (e.g., "Add symbols," "Increase length").

Network Log Analyzer

What It Does

Scans raw system or network logs, intelligently connecting individual lines to identify sophisticated, multi-step threats.

How to Interpret the Results

Correlated Threats: This is the core of the tool. It doesn't just find single bad lines; it understands context. For example, it will see 20 failed logins followed by one successful login from the same IP and flag it as a "Brute-Force Attack (Successful)", which is far more critical than 20 failed logins alone.
Threat Score & Level: A calculated score that represents the overall risk level of the entire log file. This helps you prioritize investigations. A "CRITICAL" level indicates an active, successful compromise is likely.
IP Watchlist: This allows you to provide your own list of known-bad IP addresses. The tool will then flag any and all activity from these IPs as a CRITICAL threat, making it easy to spot repeat offenders or track specific actors.

About P.H.A.N.I.X

A closer look at the mission, features, and design philosophy behind this forensic suite.

Our Mission

P.H.A.N.I.X was born from a simple yet powerful idea: to democratize digital forensics. We believe that powerful analysis tools should be accessible, secure, and transparent. Our core philosophy is built on client-side processing, meaning every calculation, every analysis, and every byte of your sensitive data remains exclusively on your computer. There are no server uploads, no hidden data collection, and no complex installations required. This approach not only guarantees absolute privacy but also makes sophisticated forensic techniques available to anyone with a web browser, from students learning the trade to professionals in the field conducting initial assessments.

Privacy by Design

Your privacy is not an afterthought; it is the foundation of this suite. Here is our commitment to you:

Zero Data Transmission

All files you select and data you paste are processed locally within your browser. Nothing is ever sent to, or stored on, any external server. Your evidence remains your own.
No Tracking Cookies

This tool does not use tracking cookies or third-party analytics that monitor your behavior. Settings are stored in your browser's `localStorage`, which you control and can clear at any time.
Open and Verifiable

As a single-file HTML application, the entire source code is visible and can be audited by anyone. You can save the page and run it offline to verify its client-side nature.

Support & Contact

For questions, bug reports, or feature suggestions, please feel free to reach out. Your feedback is valuable for the continued improvement of this suite.

Contact: nittalaphaneendhar@gmail.com

Important Notice & Terms of Use

This tool is developed for educational and professional assessment purposes. For any serious or legal investigations, findings must be verified with judicially validated forensic tools. Always consult a certified digital forensics professional for official case work. By using this tool, you acknowledge its purpose and agree that the developer is not liable for any misuse or conclusions drawn from its results. You are responsible for your own actions and for complying with all applicable laws.

Phaneendhar.Nittala

P.H.A.N.I.X

Explore Specialized Forensic Tools

P.H.A.N.I.X Lab

Forensic QR Generator

N.I.T.T.A.L.A v7.4

Integrity & Threat Scanner

File Comparison Tool

Metadata Analyzer

Steganography Analyzer

Password Audit

Advanced Network Log Analyzer

Chain of Custody Timeline

Add Manual Chain of Custody Entry

P.H.A.N.I.X Forensic Guide

Integrity & Threat Scanner

What It Does

File Scan Mode

URL Integrity Check Mode

Comparison Tool

What It Does

How to Interpret the Results

Metadata Analyzer

What It Does

How to Interpret the Results

Steganography

What It Does

How to Interpret the Results

Password Audit

What It Does

How to Interpret the Results

Network Log Analyzer

What It Does

How to Interpret the Results

About P.H.A.N.I.X

Our Mission

Privacy by Design

Zero Data Transmission

No Tracking Cookies

Open and Verifiable

Support & Contact

Important Notice & Terms of Use