Replace binwalk, file, ExifTool, and strings with a single, ultra-fast binary. Zero dependencies. AI-integrated.
One binary replaces your entire forensic stack
filo-go combines a dozen forensic tools into one optimized binary. No more context-switching or dependency hell.
Replaces binwalk, file, ExifTool, and strings with a single, fast, cross-platform binary. No more context-switching between tools.
Built in Go. No Python, Perl, or C libraries required. Just a single ~5.7MB static binary that runs anywhere.
Built-in MCP (Model Context Protocol) server enables AI-assisted forensic analysis via Claude Desktop and other AI tools.
Extend functionality with dynamic Go plugins. Write custom analyzers for your specific forensic needs without forking the project.
Entropy visualization, steganography detection, encryption detection, YARA rule matching, and multi-algorithm hashing.
Analyze PCAP network captures, Windows Registry hives, Windows Event Logs (EVTX), SQLite databases, and firmware images.
See how filo-go stacks up against the legacy tools it replaces.
| Feature | binwalk | file | ExifTool | filo-go |
|---|---|---|---|---|
| Language | Python/C | C | Perl | ✅ Go |
| Dependencies | Many | libmagic | Perl modules | ✅ None |
| Cross-platform | ⚠️ Partial | ✅ | ✅ | ✅ |
| Single binary | ❌ | ✅ | ❌ | ✅ |
| JSON output | ❌ | ⚠️ | ✅ | ✅ |
| MCP integration | ❌ | ❌ | ❌ | ✅ |
| Plugin system | ❌ | ❌ | ✅ | ✅ |
| Firmware extraction | ✅ | ❌ | ❌ | ✅ |
| Metadata extraction | ❌ | ❌ | ✅ | ✅ |
| YARA support | ❌ | ❌ | ❌ | ✅ |
| Performance | Slow | Fast | Fast | 🚀 Fastest |
Optimized for modern multicore architectures. Process data at the speed of Go.
Logarithmic scale · measured on Intel Xeon Platinum 8488C, Linux AMD64
Install from source, via go install, or download a pre-built binary.
Every command follows a consistent pattern. No cryptic flags.
Connect filo-go to Claude and other AI tools for AI-assisted forensic analysis.
{
"mcpServers": {
"filo": {
"command": "/path/to/filo",
"args": ["mcp"]
}
}
}Add this to your Claude Desktop configuration file to enable AI-assisted file analysis.
filo-go supports dynamic Go plugins for custom analysis and detection without forking.
package main
import "github.com/supunhg/filo-go/internal/plugins"
type ArchiveBombDetector struct{}
func (d *ArchiveBombDetector) Name() string {
return "archive-bomb"
}
func (d *ArchiveBombDetector) Analyze(data []byte) (*plugins.Result, error) {
return &plugins.Result{
Risk: plugins.RiskLow,
Findings: []string{"File appears safe"},
}, nil
}
func init() {
plugins.Register(&ArchiveBombDetector{})
}Deep inspection for archives, executables, documents, images, network captures, and firmware.
Every component is independently testable and replaceable.