Overview

FEX CLI™

The Forensic Explorer Command Line (FEX CLI) is a high-performance forensic data processing engine designed for digital forensics and e-discovery. It delivers speed, scalability, and automation across single systems or enterprise environments. With XML-based task control and direct programming integration, FEX CLI enables unmatched flexibility and precision in forensic workflows.

  • Automates: hash, signature, carve, registry, metadata
  • Scales: workstation to enterprise
  • Customizable via XML
  • Programmable interface
  • Exports: disk, e-discovery, L01
  • Portable for triage
  • Fast, flexible, repeatable, expandable

Quick Links

Key Features

Fast: CLI processing speed if significantly faster that processing in GUI applications.
Multiple Concurrent Instances: Initiate multiple simultaneous processing instances (requires multiple licenses).
Case File Output: Creates a Forensic Explorer case file that can be opened directly with the Forensic Explorer GUI.
Portable: The FEX CLI can be launched from a stand-alone folder and from portable storage devices.
Batch Process: Batch sequence processing jobs. Compatible with both CMD and PowerShell.
Front End Independent: Front end applications (Python, HTML5, etc.) can interface directly with CLI commands.
Inbuilt Forensic Processing Tasks: Inbuilt functions include:

  • Verification
  • Signature Analysis
  • File Carve
  • Hash
  • Hash Match;
  • Keyword Search
  • Filter
  • Create a .L01
  • Export files to disk
  • Report to PDF, RTF, HTML
Remote: Can be configured to process remote devices running the FEX servlet.

Technical Features

Recommended Requirements

FEX CLI is a 64 bit application.

Minimum recommended system requirements are:

  • Windows 10
  • i7 or above
  • 16 GB RAM

Supported File Systems

Forensic Explorer supports analysis of:

  • Windows FAT12/16/32, exFAT, NTFS,
  • Macintosh HFS, HFS+, APFS
  • EXT 2/3/4

Encryption Support

Unlocks the following (password or recovery key required):

  • Bitlocker (Microsoft Windows)
  • FileVault 2 (MAC)

Supported Bit-Image Formats

FEX-Triage supports common image and forensic image formats including:

  • AD1, AFF, DD, DMG, BIN, RAW, E01, Ex01, L01, Lx01, VMD, VHD, VHDX.

Supported Email Formats

Supports analysis of PST, OST, EDB and MBOX mail formats.

Email messages are exported in .msg format.

Scripting Language

FEX Triage scripts are written in Delphi Pascal.

Processing Profiles

Processing profiles are created in .TXML (XML) format. Profiles use TCommandTasks to initiate processing, which includes the ability to call and run scripts and filters. Common TCommandTasks are:

TCommandTask_CacheThumbNails Cache graphics in case.
TCommandTask_CacheVideoThumbNails Cache video in case.
TCommandTask_CreateHash Hash files.
TCommandTask_DataStore Sets the data store (e.g. Email).
TCommandTask_ExpandCompoundFiles Expands compound files.
TCommandTask_ExportEntryList Exports a list of files as CSV.
TCommandTask_ExportFiles Exports files to disk.
TCommandTask_ExportFilesL01 Exports files to L01.
TCommandTask_FileTypeAnalysis Signature analysis.
TCommandTask_Filter Runs a filter script.
TCommandTask_MatchHash Performs a hash match.
TCommandTask_Parallel Runs command tasks in parallel.
TCommandTask_ReportGenerator Creates a report in PDF, RTF, HTML.
TCommandTask_Script Runs a script.
TCommandTask_SearchforKnownFS Locates a file system (e.g. NTFS).
TCommandTask_SearchforKnownMBR Locates a Master Boot Record.
TCommandTask_SearchforLostFiles Carve for files.

Case Use Examples

Forensic Backlog

A law enforcement agency has a backlog of 100 forensic image files on their server.

Solution:

  • 6 FEX CLI licenses is configured to sequentially process job folders on the server. A search profile is selected for each type of job (e.g. drugs, fraud, child protection, etc.), triggered by folder name.
  • Processing tasks include registry triage, keyword search, carving, artifact analysis, galley cache, video keyframe extraction, hash match etc. Files of interest are bookmarked. Reports are created and exported to disk. Key files are written and exported to L01.
  • If average case processing time is 2 hours, the total processing time for all cases is less than 48 hours.
  • Each case officer receives a folder of reports and files to review.
  • Cases needing more detailed forensic examination are quickly identified. The pre-processed CLI case is available as the starting point for the forensic examiner.

Email Discovery

A company is subpoenaed for all email correspondence between two parties. Email exists in PST, OST, EDB, Mbox format.

Solution:

  • FEX CLI searches the network store to collect email files for processing.
  • Email files are examined and messages from the the two parties are collected.
  • Messages are exported directly to .L01 format.

Purchase & Licensing FAQs

License Type

A FEX CLI license is a fixed term license and will expire at the term date (typically 1 year).

A FEX CLI license can be renewed at a maintenance rate. A grace period of 6 months will apply to an expired license, after which time the maintenance rate will no longer apply.

Wibu CodeMeter Activation Dongle (Wibu Dongle)

The software is activated by a license on a Wibu Dongle. A Wibu Dongle can hold one or more licenses. It can be:

  • Connected locally (i.e. plugged into the computer in use); or
  • Connected to a remote computer and accessed over a network.

License Management

Wibu Dongle licenses are managed using the GetData License Manager software (download here). The License Manger is used to:

  • View license information.
  • Add a license to a Wibu Dongle.
  • Rename a dongle.
  • Apply firmware updates.

A lite version of Wibu CodeMeter software is installed with GetData products. A full version of CodeMeter User Runtime for Windows is available from the Wibu website. It can be used to:

  • Configure a computer and dongle to be used as a license server;
  • Configure a computer to be used as a network client;
  • Rename a dongle, apply firmware updates, and other maintenance functions.

Learn more about license management here.

License Delivery

Wibu Dongles are shipped worldwide by FEDEX. Web tracking information is provided for each shipment. Courier delivery costs are included in the checkout process.

Download

FEX CLI 64 bit – Portable

Setup Instructions:

  1. Download and expand the ZIP file.
  2. CLI is located in: ..\Forensic Explore CLI\bin64\FEX_CommandLine.exe

Note: The installation contains a python executable ‘fex_cli_launcher.exe’ with source code. This program can be used to pass commands to FEX_CommandLine.exe.

Purchase

FEX CLI Yearly SubscriptionUSD 1,000.00
Shipping world wide by courierUSD 50.00
TotalUSD

Maintenance Renewal

1 Year Subscription Renewal USD 1,000.00

Change Log

20 September 2025- 5.6.8.6594

  • Updates in-line with FEX-GUI changes.

29 August 2025- 5.6.8.6544

  • Updates in-line with FEX-GUI changes.

16 July 2025- 5.6.8.6364

  • Evidence – Improved image verification speed by 30%.

03 July 2025- 5.6.8.6348

  • Artifacts – Added artifacts as per FEX-GUI updates.
  • Fixed issue using BitLocker recovery keys from text file.
  • Other minor script updates.

9 May 2025- 5.6.8.6228

  • Update in-line with FEX-GUI changes.

2 May 2025- 5.6.8.6192

  • Update in-line with FEX-GUI changes.

11 Mar 2025- 5.6.8.6064

  • Update in-line with FEX-GUI changes.

07 Feb 2025- 5.6.8.5970

  • Update in-line with FEX-GUI changes.

08 Jan 2025- 5.6.8.5908

  • Script maintenance.

22 Dec 2024 – 5.6.8.5838

  • Script maintenance.

11 Dec 2024 – 5.6.8.5802

  • Artifacts updates.

16 Oct 2024 – 5.6.8.5622

  • Script maintenance.
  • QNX support for vehicle forensics added.

05 Oct 2024 – 5.6.8.5580

  • Artifact column updates: Life360, Waze.

27 Sep 2024 – 5.6.8.5558

  • AD1 read updates.
  • Artifact column updates.
  • VHDX read updates.

8 Aug 2024 – 5.6.8.5442

  • Script updates.
  • TCommandTask updates.

8 Aug 2024 – 5.6.8.5442

  • APFS updates.

2 Aug 2024 – 5.6.8.5432

  • Script maintenance.

23 Jul 2024 – 5.6.8.5284

  • Updated PreCRE 2 Regex.

21 Jun 2024 – 5.6.8.5282

  • Updated in line with FEX-GUI changes.

10 Jun 2024 – 5.6.8.5218

  • Added Recover Folders.

29 May 2024 – 5.6.8.5182

  • Script updates.

26 Apr 2024 – 5.6.8.5090

  • Script updates.

24 Mar 2024 – 5.6.8.4970

  • AI Graphics – Automated graphics classification with Image Analyzer (CSAM available for L.E. – contact us).
  • Yara – Scan for Yara rules.

10 Oct 2023 – 5.6.8.4386

  • TXML – Added example TXML for video keyframe extraction.
  • TXML – Updated example TXML filenames for use in FEX-LAB.
  • Other script maintenance.

8 Sep 2023 – 5.6.8.4316

  • Artifact – Updates.
  • Hash Differential, Fuzzy – Added hash error messages.
  • TAR – Improved expansion of large .TAR produced in in phone acquisitions.
  • VMDK – Added support for older VMDK files.

1 Aug 2023 – 5.6.8.4184

  • Artifacts – Added support for additional browser, chat, health artifacts.
  • L01 – Created L01 files now store and acquisition hash in the image header.

22 Jul 2023 – 5.4.8.4138

  • Script updates for iOS and Android.

11 Jul 2023 – 5.4.8.4070

  • Script updates.

1 Jun 23 – 5.4.8.3964

  • Script updates.

20 May 23 – 5.4.8.3902

  • Script updates.

24 Apr 23 – 5.4.8.3818

  • Script updates.

17 Feb 23 – 5.4.8.3778

  • Video – Improved extraction of video key frames.

17 Feb 23 – 5.4.8.3710

  • Reports – Fixed DPI error when exporting reports.

17 Feb 23 – 5.4.8.3704

  • Updates required for FEX-LAB.
  • Updated hash sets and associated TXML.

17 Feb 23 – 5.4.8.3676

  • TXML and Script updates.

17 Feb 23 – 5.4.8.3584

  • General Filter and Script updates.

13 Jan 23 – 5.4.8.3514

  • General Filter and Script updates.

13 Jan 23 – 5.4.8.3474

  • File Carve – Fixed a freeze on a specific WMV file carve.

9 Jan 23 – 5.4.8.3468

  • JSON – Fixed issue populating Hash Match Category number.
  • Other minor updates.

31 Oct 22 – 5.4.8.3218

  • Expand compound files update.
  • Script and Filter updates.

2 Oct 22 – 5.4.8.3184

  • Script updates.
  • Other updates inline with FEX GUI.

23 Aug 22 – v5.4.8.2938

  • Added xxHash.

12 Aug 22 – v5.4.8.2938

  • Script and Filter updates.

23 Jul 22 – v5.4.8.2892

  • FEX-LAB updates.

15 Jul 22 – v5.4.8.2868

  • Reports – Added ability to blur reports on export.

See other Get Data Products

GetData Forensics provide cutting edge software and solutions to reduce forensic backlogs, streamline digital investigations and maximize results.

About FEX Cloud Capture™ (free)

FEX Cloud Capture

About FEX Cloud Capture™ (free) FEX Cloud Capture™ is a software tool for the acquisition of data stored on...

Learn More
Free

FEX Imager™ (free)

This forensic imaging tool captures bit-level images with full hash verification (MD5, SHA1, SHA256) from physical drives, logical...

Learn More
GetDataForensics_ProductTiles2

FEX CLI™

The Forensic Explorer Command Line (FEX CLI) is a high-performance forensic data processing engine designed for digital forensics...

Learn More