pts-project.org

What It Is

PiRogue Tool Suite (PTS) is an AGPL v3 open-source mobile device forensics and digital investigation platform, primarily built for civil society organizations, digital rights defenders, researchers, journalists, and regulators. It is not an antivirus, EDR, or perimeter protection product in the traditional sense. Instead, it is a forensics and threat analysis toolchain centered on discovering evidence, analyzing mobile app behavior, preserving investigation materials, and collaborating on cases.

Core Capabilities

In terms of protection and investigation capabilities, PTS covers network traffic analysis, consent-based Android device forensics, dynamic app analysis, threat intelligence aggregation, case management, and evidence preservation. PiRogue can be used as a portable Raspberry Pi-based network routing and analysis device to capture and analyze communications from phones, computers, and other endpoints, helping identify suspicious connections, data leakage, and application communication patterns. Colander provides web-based case management, knowledge graphs, artifact management, link preservation, collaboration, and reporting. Threatr aggregates intelligence sources such as VirusTotal, OTX, Shodan, Scarlet Shark, and MISP, and exposes the results via REST API for SIEM, SOAR, or automation workflows.

Deployment, Pricing, and Integrations

Deployment is more self-hosted and technical in nature. PiRogue can run on a Raspberry Pi, or be virtualized or adapted to a standard PC. Colander and Threatr are Web/API platforms and support local deployment. On pricing, the available materials only clearly state the AGPL v3 open-source license; they do not disclose commercial subscriptions, SaaS plans, hardware pricing, or enterprise SLA options. Integration capabilities are strong, with support for REST API, MISP, STIX2, JSON, CSV, Mermaid, Graphviz/dot, Jinja templates, as well as YARA, CyberChef, and external threat intelligence sources.

Pros, Cons, and Who It’s For

The main advantages are that it is open source, transparent, and cost-friendly. It also connects traffic collection, TLS/payload analysis, evidence signing, knowledge graphs, and collaborative investigations into a relatively complete workflow. It is especially suitable for investigating mobile app privacy violations, analyzing spyware, collecting evidence for public interest litigation, and security education. The limitations are also clear: the available text does not show compliance certifications, commercial support, or a mature alerting system. Users need to understand network packet capture, mobile forensics, TLS decryption, and threat intelligence, so the learning curve is relatively high for non-technical users.

Access from China and Alternatives

The available materials do not specify access conditions from China. The official website, Discord, GitHub, and external intelligence sources may be affected by the local network environment, and payment methods are not disclosed. If partial alternatives or complementary tools are needed, Wireshark can be used for traffic analysis, MVT for mobile forensics, MISP for threat intelligence sharing, CyberChef for data processing, and VirusTotal, OTX, Shodan, and similar services for external intelligence lookup.