diff --git a/modules/default.nix b/modules/default.nix
index 49fa094..bba8b18 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -3,6 +3,7 @@
     ./options.nix
     ./podman.nix
     ./desktop/gnome.nix
+    ./desktop/forensics.nix
     ./desktop/hyprland.nix
     ./desktop/kde.nix
     ./desktop/mimeapps.nix
diff --git a/modules/desktop/forensics.nix b/modules/desktop/forensics.nix
new file mode 100644
index 0000000..ad5850c
--- /dev/null
+++ b/modules/desktop/forensics.nix
@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }:
+
+let cfg = config.modules.desktop.forensics;
+in {
+  options.modules.desktop.forensics = {
+    enable = lib.mkOption {
+      default = false;
+      example = true;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    user.packages = with pkgs; [
+      acquire
+      afflib
+      autopsy
+      fatcat
+      foremost
+      hstsparser
+      networkminer
+      sleuthkit
+      testdisk-qt
+      tracee
+    ];
+  };
+}