"It only reads its own config"
Then why did it open a file in another user's folder? Documentation and code reviews describe what an app should do, not what it does.
01
Free for Windows · v0.1.0
FerroTrace See what your application really does. From the outside.
FerroTrace watches a running application and records what it does with files, databases, the network, its configuration and other programs, without changing it or adding anything to it. Then it shows what the app depends on, flags the unusual parts with the evidence, and can explain them in plain language.
- No code changes, no source code needed
- Alerts with the evidence
- Works with any AI, or none
- Everything stays on your PC
- Changes to your app
- 0
- Detection rules
- 14
- Events per session
- 1M+
- Price
- $0
Software does more than anyone wrote down
You can't secure, migrate or debug what you can't see.
Every application touches files, hosts, databases and other programs nobody listed. FerroTrace watches it run and writes it all down, so you work from what it did, not from what someone remembers.
The update that changed everything
After an upgrade the app talks to a new host, opens a port and starts a helper program. Nobody noticed, because nobody was looking.
02The dependency nobody wrote down
The service works on every machine but one. Somewhere there is a file, a database or an API it quietly needs.
03No source code, no logs, no time
A third-party tool, an old internal app or a vendor's agent. You can't add logging to it, and you still have to know what it does.
04Three steps, no setup
Point it at a program. Use the program.
- 1Choose what to watch
A program that is already running, one FerroTrace starts for you, or everything started from a folder.
- 2Use the app as usual
Click through it, run its tests, let it do its nightly job. FerroTrace records what it does while it runs.
- 3Read what happened
Every file, query, connection and program it touched, alerts for the unusual parts, and a map of what it depends on.
What it records
- Files
- Processes
- Network & DNS
- Listening ports
- PostgreSQL
- MySQL & MariaDB
- SQL Server
- SQLite
- Config changes
From raw events to answers
Not just what happened. What matters.
Alerts with their evidence, a map that compares runs, every event, and an explanation when you want one.
Alerts with evidence
Know what was unusual, and why it was flagged.
Detection rules watch every event as it arrives. When something looks wrong, FerroTrace says what happened in a sentence and shows the exact events behind it, so you can judge it yourself.
- 14 rules out of the box: secret-looking files read, files changed outside the app's folders, bursts of file changes, command shells started, ports open to the network, new external hosts, configuration changed just before a new connection, destructive or unusual database statements and more
- Turn rules on or off, change their severity and thresholds, or copy one as the start of your own
- Compare with a normal run and only what is new gets flagged
- The first alert for the demo app arrives within seconds of starting it
Dependency map
See what changed between two runs.
FerroTrace draws what the application depends on: its folders, configuration, hosts, ports, databases and the programs it starts. Compare a run with a normal one and everything new is marked.
- Paths and ports that change every run are generalized, so two runs of the same app draw the same map
- New and gone dependencies listed beside the map, with their kind and where they live
- Click any node to see the events behind it
- The quickest way to see what an update, a configuration change or an incident changed
Every event
Every file, query and connection, as it happened.
The full record of what the application did, newest first. Filter by type, result or process, search paths, hosts and queries, and open any event for every detail.
- Files: opened, read, written, renamed and deleted, with bytes and whether it worked
- Network: connections, DNS lookups, bytes sent and received, and listening ports
- Databases: statements from PostgreSQL, MySQL, MariaDB and SQL Server query logs, and SQLite from file activity
- Anything FerroTrace could not see is shown as not visible, never as an empty value
- Passwords, tokens, card numbers and the values in queries are masked before anything is saved
AI explanations
Ask what it means. See exactly what is sent first.
FerroTrace can explain an alert, or the events you selected, in plain language: what probably happened, the likely causes and what to check next. Every explanation names the events it is based on.
- Local models first: Ollama, LM Studio or any OpenAI-compatible server on your computer
- Cloud providers (OpenAI, Anthropic or your own endpoint) only if you turn local-only mode off
- A preview of exactly what will be sent, already masked, before every request
- Explanations are labelled as suggestions and name the provider and model; the instructions sent to the model are files you can edit
- Optional. FerroTrace works fully without any AI
Honest about what it sees
Built on what Windows already reports.
FerroTrace reads the system's own records of what each program does. That is why it needs no code change, and why it can't break the application. Where it can't see something, it says so.
- Full capture: With administrator rights, FerroTrace reads Windows' own event tracing: every process, file and network event, from the first instruction. Windows asks for permission each time, for FerroTrace's small capture agent only.
- Reduced mode: Without them, FerroTrace still records processes, connections, listening ports and file changes in the app's folders, and says exactly what it can't see.
- Measured, not promised: Watching costs a busy program a few percent of its speed (3% to 5.4% on our deliberately busy benchmark), and the views stay fast with a million events in a session.
Rules you control
Tune what gets flagged, in plain settings.
Every rule says what it looks for and why it matters. Change its severity, its thresholds or the folders your application is expected to use, turn it off, or copy it as the start of your own. Your changes apply to every session, recorded or not.
Everything else you'd expect
Done properly.
-
01
Timeline
Activity over time by type. Drag across it to zoom in, and the range filters every other view.
-
02
Files and databases
The most used, slowest and failing files and queries, and secret-looking files on their own.
-
03
Reports anyone can open
One HTML file with the summary, timeline, alerts, evidence, AI explanations and the map. Opens offline and prints well.
-
04
Raw data
Every event, alert and explanation as JSON Lines, ready for your own scripts and tools.
-
05
Sessions
Every run is saved. Name, pin, compare and clean them up automatically by age or size.
-
06
Command line
Watch, record, compare, map, report and export from scripts with ferrotrace watch and ferrotrace sessions.
-
07
A demo app included
A small shop that does a few suspicious things on purpose, so you can see FerroTrace work in your first minute.
-
08
Light, dark & keyboard
Themes that follow Windows, a command palette and shortcuts for every view.
Private and transparent by design
It watches openly, and keeps what it sees to itself.
- Nothing attached to your appFerroTrace never injects code, installs a driver or changes the application it watches. It can't crash it.
- Always visibleA bar shows what is being watched, with a stop button. FerroTrace never hides itself.
- Stays on your computerEverything recorded is stored locally. No account, no telemetry, no update checks.
- Secrets masked firstPasswords, tokens, keys and query values are masked inside the capture agent, before anything is saved.
Works with any Windows application
If it runs on Windows, FerroTrace can watch it.
Any language, any framework, with or without its source code. Only applications you own or may test.
- Third-party tools
- Vendor agents
- Legacy apps
- Before an upgrade
- After an incident
- Security reviews
- Your own services
- Onboarding
FerroTrace vs raw system tools
From a wall of events to a clear answer.
| Capability | Process and packet monitors | FerroTrace |
|---|---|---|
| What you get | Thousands of raw system events | What your app did, grouped and explained |
| Following one application | Build the filters yourself | Its child processes followed automatically |
| Database queries | Not visible | From server query logs, values masked |
| Spotting the unusual | Read everything and hope | 14 rules, with the evidence |
| Comparing two runs | Two exports and a diff tool | New and gone dependencies on a map |
| Sharing what you found | Screenshots | A report anyone can open |
| Secrets in the data | Recorded as they are | Masked before saving |
| Price | Free | Free |
Get FerroTrace 0.1.0 · Free
Your first alert in under a minute.
We'll email you a one-time code, and the download starts as soon as you enter it.
Windows
Windows 10 and 11, 64-bit
Install & first launch
Install
Run the installer. It installs for all users in Program Files and asks for administrator rights once, because the capture agent must live where only administrators can change it. On Windows 10, it adds Microsoft's WebView2 if it's missing.
First launch
If Windows shows "Windows protected your PC", choose More info, then Run anyway. FerroTrace then asks you to confirm you only monitor applications you own or may test.
Try the demo
Click Watch an application, then Try the demo. Alerts appear within seconds, and the map shows what the run added compared with a normal one.
The first-launch warning appears because FerroTrace is new and not yet widely downloaded; it only shows once. Updating: install the new version over the old one, and your sessions, rules and settings are kept. Verify your download (optional): the installer's SHA-256 checksum is in SHA256SUMS.txt.
FAQ
Questions, answered.
Something else? Ideas or partnership enquiries? Email jamal@unravelers.tech.
Is FerroTrace really free?
Yes. Download it and use it as much as you like.
Do I need to change my application?
No. FerroTrace watches from the outside, through what Windows itself reports. Nothing is installed into the application, and it doesn't need its source code.
Can it slow down or crash the application?
It can't crash it: nothing is attached to it. Watching costs some speed on very busy programs (3% to 5.4% on our deliberately busy benchmark), and if part of FerroTrace's capture fails, the application keeps running and the failure is recorded.
Why does it ask for administrator rights?
Full capture reads Windows' kernel event tracing, which only administrators may read. Only FerroTrace's small capture agent gets those rights, after a Windows prompt, never the watched application or the FerroTrace window. You can also watch without them, in reduced mode.
Can it read encrypted traffic or passwords?
No. It records where connections go and how much they send, not the encrypted content. Secrets it does see, in command lines, URLs or queries, are masked before anything is saved.
Which databases does it see?
PostgreSQL, MySQL, MariaDB and SQL Server, from their query logs (FerroTrace shows what to turn on), and SQLite from file activity, with no setup.
Does it send my data anywhere?
No. There is no account, no telemetry and no update check. The only connections it makes are to an AI provider you set up, when you click Send, and to a SQL Server you asked it to read from.
May I monitor any application?
Only applications you own or are authorized to test. FerroTrace asks you to confirm that before it watches anything, and always shows what it is watching.
Is there a macOS or Linux version?
Not yet. FerroTrace is for Windows 10 and 11 (64-bit) today.
Before the next upgrade, audit or incident
Know what your application does. Not what it's supposed to do.
FerroTrace is free for Windows. Watch the demo app in your first minute, then point it at the program you've been wondering about.