← Store  ·  // product

openredact

openredact is an open-source investigation toolkit: it recovers defective redactions by removing cover paint without regenerating content, routes evidence by magic bytes, extracts and correlates entities, and runs scope-gated recon for authorized engagements. Support and customisation from $299.

  • Python
  • CLI
  • Forensics
  • MIT
  • Authorized use only
from $299support & customisation
Contact to purchase Ask a question
⚠ Lawful use only — liability noticeopenredact is published for lawful investigation, forensics and authorized testing. Recovery, acquisition and recon features act only within a declared scope, and you must hold the right to examine any file, device or system you point it at. Provided as-is, without warranty; Cyber Sec accepts no liability for misuse.

// what it is

Recover what the black bars were hiding

openredact began as a tool for one problem — defective redactions, black bars painted over text that is still present in the file. It has grown into a broader investigation toolkit that routes evidence by content rather than by file extension, extracts and correlates it, and — for authorized penetration tests — drives standard reconnaissance tools behind a strict engagement scope.

It never regenerates, re-types, or AI-fills content. For redaction it works only with the bytes already in the file: it finds the cover paints and removes exactly those, then proves the result with per-check pixel and text-equality verification. For everything else it sniffs the real type by magic bytes, so a .pdf that is really an HTML age-gate page is flagged as a masquerade instead of being silently mis-parsed.

Every capability that touches a device, a credential, a remote host, or an encrypted container is authorization-gated: it refuses to act outside a declared, lawful scope. One CLI, auditable, and honest about its limits.

// capabilities

What it does

Defective-redaction recovery

PDF, DOCX, XLSX, image, ZIP and video cover-paint detection and removal — verified with pixel and text-equality checks, never regenerated.

Content-routed intake

Content sniffing, parallel hashed inventory, extension/content mismatch detection and dedup, so files are analysed by what they really are.

Entity & secret extraction

Emails, phones, IDs, cards, IBANs, case and Bates numbers, crypto and names — linked into a co-occurrence graph, with timelines and geolocation clustering.

Evidence handling

Multi-algorithm hashing with known-file filtering, chain-of-custody case management, full-text (FTS5) indexing and YARA triage.

Mobile & cellular

APK static analysis, SIM elementary-file parsing, Windows Event Log (EVTX) parsing, Qualcomm DIAG parsing and defensive IMSI-catcher detection.

Scope-gated recon

For authorized engagements only: nmap, subfinder, dnsx, httpx and ffuf driven behind a declared engagement scope that the tool enforces.

// under the hood

Specifications

Language
Python (single CLI)
Version
0.1.0
License
MIT
Install
pip install -e . then openredact --help
Interfaces
Command-line, scriptable
Intended use
Lawful investigation, forensics and authorized testing only

// what you pay for

Support, not a paywall

openredact’s source is open (MIT). What you pay for is the person who built it.

  • Installation & configuration help — stood up in your environment and tuned to your evidence workflow, not left as a README you fight alone.
  • Case-specific analyzers — new extractors, parsers or report formats built for the documents and devices you actually handle.
  • Bug fixes & improvements, prioritised for you — issues you hit move to the front of the queue.
  • A direct line to the engineer who wrote it — no support tier relaying questions to a team you never meet.
Contact to purchase

// the fine print

Terms & liability

Lawful use only. openredact is for legitimate investigation, digital forensics, research and authorized security testing. You alone are responsible for how you use it, and you must have the legal right to examine any document, device, container or system you process.

No liability. To the maximum extent permitted by law, Cyber Sec and Stephan Botes accept no liability for any direct, indirect, incidental or consequential damage, data loss or legal consequence arising from the use — or misuse — of this tool. Everything is provided as-is and without warranty.

What the fee buys. The price shown is a starting point and covers the engineer’s time — setup, custom analyzers, fixes and improvements. The source is MIT, so you are paying for the work and the time, not for access.

Questions about scope, licensing, or authorization? Get in touch first.

↑