forensics-colorize

forensics-colorize is designed to show differences between files using color graphics, making it ideal for comparing large files such as filesystem images. Traditional diff tools produce overwhelming output for large textual files and are unsuitable for binary files, but forensics-colorize creates intuitive graphics that quickly convey the level of changes.

The package includes two command line programs: filecompare and colorize. filecompare generates a special auxiliary input file from two target files, which colorize then uses to produce the visual comparison graphic. This workflow simplifies perceiving differences, especially in forensic analysis scenarios involving disk images or large binaries.

Use cases include digital forensics investigations where visual overviews of file modifications are needed, such as verifying integrity of filesystem images or detecting tampering in binary data.

The tool operates in two steps: filecompare processes two input files (FILE1 and FILE2) using configurable block sizes to create an auxiliary input file that captures differences. colorize then reads this auxiliary file and generates a color graphic image, with options to control data flow direction, image orientation, output width, and color schemes, providing a visual heatmap of changes.