# FEX Core SDK v1.3.1

**Build forensic applications in weeks, not years.**

## Overview

The FEX Core SDK enables developers to read and analyze forensic disk images (exact copies of storage devices) using a powerful C API. Whether you're building digital investigation tools, security software, or data recovery applications, FEX Core eliminates the complexity of low-level image and filesystem parsing.

**What you get:**
- Support for industry-standard forensic image formats (DD, E01, L01, AD1, AFF4, and more)
- Read files from FAT, NTFS, ext2/3/4, APFS, HFS+, and many other filesystems
- Simple API accessible from Python, C#, C++, or any language with C FFI
- Complete documentation and example applications

**FEX Core SDK v1.3.1**
(c) 2026 GetData Forensics. All rights reserved.

---

> **Platform support — 1.3.0:** This release ships **Windows x64 only**. The
> Linux x64 binary (`libfexcore.so`) and the `getdataforensics/fexcore-*`
> Docker images are deferred to a 1.3.x patch release. The previously published
> `1.2.1` Docker images use the older Delphi-`TDateTime` date encoding and are
> **not** wire-compatible with the FILETIME conversion examples in this SDK's
> docs — do not pair them.

## What's Included

### Core Components

- **`bin/Win64/`** - Windows x64 runtime libraries
  - `FEX.Core.dll` - Main forensic processing library
  - 7 dependency DLLs (see [Windows Dependencies](docs/windows-dependencies.md))

- **`bin/Linux64/`** - *(empty in 1.3.0 — Linux binary deferred to 1.3.x)*

- **`python/`** - Python SDK
  - `core/` - Cross-platform wrapper module (loader, constants, FexCore class)
  - `fex_viewer.py` - Image viewer/browser tool
  - `fex_extract.py` - Bulk file extraction tool

- **`docker/`** - Docker deployment scaffolding *(images for 1.3.0 not yet published — see Platform support note)*
  - `Dockerfile.alpine` / `Dockerfile.ubuntu` / `docker-compose.yml`

- **`docs/`** - Documentation
  - [Quick Start Guide](docs/quick-start-python.md) - Get started in 10 minutes
  - [API Reference](docs/api/) - V1, V2, V3 APIs and error codes
  - [Windows Dependencies](docs/windows-dependencies.md)
  - [Linux Dependencies](docs/linux-dependencies.md)
  - [Docker Guide](docker/README.md) - Alpine vs Ubuntu, glibc/musl

- **`include/`** - C header file
  - `FEX.Core.h` - Complete API declarations

- **`sample-data/`** - Test data
  - `sample-image.dd` - 50MB FAT32 forensic disk image

---

## Quick Start (Python)

Get up and running in under 10 minutes. See the [full Quick Start Guide](docs/quick-start-python.md) for detailed examples.

### Prerequisites

- Python 3.14 or higher (standard library only, no pip install needed)
- Windows x64 (Linux x64 deferred to 1.3.x — see Platform support note above)

### 1. Initialize and View Image Info

```python
import json, os
from core import FexCore
from core.loader import load_library

# Load library and initialize. Get a FEX2 key from sales@getdata.com
# and put it in the FEX_LICENSE_KEY environment variable.
lib, path = load_library()
fex = FexCore(lib)
fex.init_library(os.environ["FEX_LICENSE_KEY"])

# Open image and display metadata
image_id = fex.open_image("evidence.E01")
info = json.loads(fex.image_info_json(image_id))
print(json.dumps(info, indent=2))
```

### 2. List Files

```python
result, file_count = fex.read_file_system(image_id)
result, records = fex.get_file_system_records(image_id)

for rec in records:
    print(f"{rec.get('path', rec['filename']):60s}  {rec['logicalSize']:>12d}")
```

### 3. Extract Files

```bash
cd python
python fex_extract.py /path/to/evidence.E01 ./output
```

---

## Docker Hub Images

Docker images for **1.3.0 are not yet published** — see the Platform support
note near the top of this README. The legacy `1.2.1` images remain on Docker
Hub but pre-date the FILETIME date encoding shown throughout this SDK's docs,
so the date-conversion snippets here will produce wrong values when run against
those images.

A 1.3.x patch release will publish refreshed `getdataforensics/fexcore-slim`
and `getdataforensics/fexcore-alpine` images. See [Docker Guide](docker/README.md)
for the planned image structure.

---

## Supported Forensic Image Formats

| Format | Extensions | Description |
|--------|-----------|-------------|
| EnCase | .E01, .Ex01 | Expert Witness (physical images) |
| EnCase Logical | .L01, .Lx01 | Logical evidence files |
| AccessData | .AD1 | AD1 logical images |
| Raw/DD | .dd, .raw, .img | Raw disk images |
| AFF4 | .aff4 | Advanced Forensic Format 4 |
| Split Raw | .001 | Multi-part raw images |
| VMDK | .vmdk | VMware disk images |
| VHD/VHDX | .vhd, .vhdx | Microsoft virtual disks |
| DMG | .dmg | Apple disk images (including sparse) |

## Supported Filesystems

FAT12/16/32, exFAT, NTFS, ext2/3/4, APFS, HFS+, XFS, Btrfs, UFS, and more.

---

## License Keys

FEX Core SDK requires a license key to activate. Keys are issued by
GetData Forensics and look like `FEX2-…` strings — copy yours from your
sales email and set it in the `FEX_LICENSE_KEY` environment variable
before running the examples.

See **[License Keys](docs/license-keys.md)** for installation steps,
code samples, and security notes.

### Trial / Evaluation
Contact **sales@getdata.com** with subject "FEX Core SDK Trial Request" — a
30-day evaluation key with all features enabled will be issued.

### Production
Commercial licenses available as perpetual or subscription. Contact
**sales@getdata.com** for pricing.

---

## Documentation

| Document | Description |
|----------|-------------|
| [Quick Start (Python)](docs/quick-start-python.md) | End-to-end Python tutorial |
| [V2 API Reference](docs/api/v2-api.md) | Recommended API (DLL-managed buffers) |
| [V3 API Reference](docs/api/v3-api.md) | Custom property extraction |
| [Error Codes](docs/api/error-codes.md) | All error codes with descriptions |
| [License Keys](docs/license-keys.md) | FEX2 key format, feature flags, how to obtain a key |
| [Windows Dependencies](docs/windows-dependencies.md) | Required DLLs for Windows |
| [Linux Dependencies](docs/linux-dependencies.md) | Required .so libraries for Linux |
| [Docker Guide](docker/README.md) | Docker deployment with Alpine & Ubuntu |
| [Architecture Overview](docs/architecture-overview.md) | API design and memory patterns |

---

## Support

**Email:** support@getdata.com
**Subject Line:** "FEX Core SDK - [Brief Description]"
**Include:** SDK version (1.3.0), platform, error messages, and minimal code example

### About GetData Forensics

GetData Forensics provides digital forensic software trusted by law enforcement, government agencies, and corporations worldwide. Our flagship product, **Forensic Explorer**, is powered by the same FEX Core engine in this SDK.

**Website:** https://www.getdataforensics.com
**Sales:** sales@getdata.com
**Support:** support@getdata.com
