Is Crow-Eye free to download?

Yes. Crow-Eye is free and open-source under the GPL-3.0 licence, for personal and commercial use alike. There is no paid tier of the forensics engine and no feature is held back.

What are the system requirements?

Windows 10 or Windows 11 (64-bit), administrator privileges to read protected artifacts such as the MFT and USN journal, and about 500 MB of free disk space for the application plus room for your case data.

Should I choose the MSI installer or the portable edition?

Choose the MSI installer for a normal workstation: it registers Crow-Eye properly and updates itself. Choose the portable edition when you cannot install software on the machine, such as a locked-down or evidence-handling workstation.

How does Crow-Eye update itself?

The installer build downloads an update in the background while you work and installs it when you close Crow-Eye, so closing never waits on a download. You can roll back to your previous build in one click, or install any published version, from Settings then Updates.

Does Crow-Eye send my evidence anywhere?

No. Crow-Eye parses and correlates entirely on your machine. The Eye AI assistant is optional and can run fully offline against a local model server, so evidence never leaves your network.

Which Windows artifacts does Crow-Eye parse?

Prefetch, the MFT and USN journal, the Registry, Windows Event Logs, AmCache, ShimCache, SRUM, LNK files, Jump Lists, the Recycle Bin and browser history — from a live system or an offline forensic image.

Download Crow-Eye — Free Windows Forensics Tool (MSI)

Name: Crow-Eye
Author: Crow-Eye

Download Crow Eye

Both downloads are the Crow-Eye Windows app (a native .exe, no separate setup). The Installer (recommended) is the newest version with the latest investigation improvements and automatic updates; the Portable edition is a standalone build you run straight from a USB stick.

Recommended

Install Crow-Eye

The newest Crow-Eye — .exe — set up on your PC

Installs Crow-Eye and keeps it up to date automatically through the built-in updater, so you always have the newest version with the latest investigation features. Best for most people and permanent workstations.

Version

0.12.7

Size

~177 MB

Format

Installer (.msi)

Latest · .exe Auto-Updates Windows 64-bit

Portable Crow-Eye

Standalone Crow-Eye — .exe — runs from USB

A standalone Crow-Eye you can run from a USB stick or any Windows PC — just extract and launch, nothing to install. All dependencies included. This is the fixed v0.10.1 build.

The Portable edition stays at v0.10.1 and isn't updated. For the newest investigation features and automatic updates, install the MSI above (v0.12.7).

Version

0.10.1

Size

~220 MB

Format

Portable (.zip)

Standalone · .exe No Install Runs from USB

For developers

GitHub Release

Official release page with version history, release notes, and additional assets.

Release Date

Latest

Platform

GitHub

Release Notes Changelog Official

🔗 View on GitHub

Clone Repository

Get the full source code, contribute to development, or build from source.

git clone https://github.com/Ghassan-elsman/Crow-Eye.git

Full Source Development Open Source

📂 Open Repository

Want to see how it works?

Watch Demo Video

System Requirements

Operating System: Windows 10 or Windows 11 (64-bit)
Administrator Rights: Required for live system analysis
RAM: Minimum 4GB (8GB recommended for large datasets)
Storage: 500MB free space for application + space for case data
Python: Not required for standalone EXE (included for source builds)

Important Notes

Executable: The Crow Eye package is provided as a ZIP containing the self-contained Crow-Eye.exe. Simply extract and run - no installation needed.
Administrator Access: For live system analysis, run Crow Eye with administrator privileges to access all forensic artifacts.
Antivirus Warning: Some antivirus software may flag forensic tools. This is a false positive due to the engine's system-level access requirements.
Source Code: If you prefer to build from source or contribute to development, clone the repository and follow the setup instructions in the README.
Updates: Check the GitHub releases page regularly for the latest version and security updates.
Having Issues? Visit the Troubleshooting Guide for common problems and solutions.

Quick Start Guide

1. Download

Choose your preferred download method above. For most users, the EXE (ZIP) is recommended.

2. Run as Administrator

Extract the ZIP, right-click Crow-Eye.exe and select "Run as administrator" to ensure full access to system artifacts.

3. Create a Case

Launch the application, create a new case, and start analyzing Windows forensic artifacts.

Need Help?

If you encounter any issues or have questions:

Check the User Guide for detailed instructions
Review the Technical Documentation
Report bugs on GitHub Issues
Contact: Ghassanelsman@gmail.com

Read the User Guide

Crow Eye