Binalyze Tornado

Binalyze Tornado is a free forensic collection utility designed specifically for Business Email Compromise (BEC) and cloud investigations. The application acquires evidence from Microsoft 365 and Google Workspace environments, allowing investigators to collect email messages, attachments, mailbox metadata, audit logs, user information, and other cloud artifacts without deploying the full Binalyze AIR platform.

Tornado is intended to simplify cloud evidence acquisition during the early stages of an investigation. Rather than manually exporting data from multiple administrative portals, investigators can perform a structured collection suitable for forensic review, incident response, compliance inquiries, and legal investigations.

The tool is particularly valuable when investigating phishing campaigns, compromised mailboxes, account takeovers, executive impersonation, and business email compromise incidents. Corporate DFIR teams, incident responders, managed security service providers (MSSPs), and consultants can rapidly collect cloud evidence while preserving information needed for downstream forensic analysis.

Although Tornado performs evidence collection, it is not intended to replace a complete forensic analysis platform. Its strength lies in acquiring cloud-based evidence quickly and consistently so investigators can continue analysis using their preferred forensic workflow or integrate collections into the broader Binalyze AIR ecosystem.

Licensing: Free

Operating Environment: Windows desktop application for Microsoft 365 and Google Workspace evidence collection.

Binalyze Tornado is a free cloud evidence collection tool that enables investigators to rapidly acquire Microsoft 365 and Google Workspace forensic artifacts for business email compromise, phishing, insider threat, and incident response investigations.