Awesome Forensics

Curated list of awesome free (mostly open source) forensic analysis tools and resources.

:star: Recommended · :package: Archived · :zzz: Unmaintained (2+ years)

• Awesome Forensics
  • Collections
  • Tools
    • Distributions
    • Frameworks
    • Live Forensics
    • IOC Scanner
    • Acquisition
    • Imaging
    • Carving
    • Memory Forensics
    • Network Forensics
    • Windows Artifacts
      • NTFS/MFT Processing
    • OS X Forensics
    • Mobile Forensics
    • Docker Forensics
    • Internet Artifacts
    • Timeline Analysis
    • Disk image handling
    • Decryption
    • Management
    • Picture Analysis
    • Metadata Forensics
    • Steganography
  • Learn Forensics
    • CTFs and Challenges
  • Resources
    • Web
    • Blogs
    • Books
    • File System Corpora
    • Other
    • Labs
  • Related Awesome Lists
  • Contributing

---

Collections

• AboutDFIR – The Definitive Compendium Project - Collection of forensic resources for learning and research. Offers lists of certifications, books, blogs, challenges and more
• :star: ForensicArtifacts.com Artifact Repository - Machine-readable knowledge base of forensic artifacts

Tools

• Forensics tools on Wikipedia
• Eric Zimmerman's Tools

Distributions

• bitscout - LiveCD/LiveUSB for remote forensic acquisition and analysis
• Remnux - Distro for reverse-engineering and analyzing malicious software
• :zzz: SANS Investigative Forensics Toolkit (sift) - Linux distribution for forensic analysis
• Tsurugi Linux - Linux distribution for forensic analysis
• WinFE - Windows Forensics environment

Frameworks

• AIFT - AIFT (AI Forensic Triage) parses evidence using dissect and generates AI-assisted forensic reports.
• :star: Autopsy - SleuthKit GUI
• :zzz: dexter - Dexter is a forensics acquisition framework designed to be extensible and secure
• :zzz: dff - Forensic framework
• Dissect - Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
• :zzz: hashlookup-forensic-analyser - A tool to analyse files from a forensic acquisition to find known/unknown hashes from hashlookup API or using a local Bloom filter.
• IntelMQ - IntelMQ collects and processes security feeds
• Kuiper - Digital Investigation Platform
• Laika BOSS - Laika is an object scanner and intrusion detection system
• OpenRelik - Forensic platform to store file artifacts and run workflows
• :zzz: PowerForensics - PowerForensics is a framework for live disk forensic analysis
• :star: The Sleuth Kit - Tools for low level forensic analysis
• turbinia - Turbinia is an open-source framework for deploying, managing, and running forensic workloads on cloud platforms
• IPED - Indexador e Processador de Evidências Digitais - Brazilian Federal Police Tool for Forensic Investigations
• Wombat Forensics - Forensic GUI tool

Live Forensics

• grr - GRR Rapid Response: remote live forensics for incident response
• :package: Linux Expl0rer - Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask
• :package: mig - Distributed & real time digital forensics at the speed of the cloud
• osquery - SQL powered operating system analytics
• POFR - The Penguin OS Flight Recorder collects, stores and organizes for further analysis process execution, file access and network/socket endpoint data from the Linux Operating System.
• UAC - UAC (Unix-like Artifacts Collector) is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

IOC Scanner

• Fastfinder - Fast customisable cross-platform suspicious file finder. Supports md5/sha1/sha256 hashes, literal/wildcard strings, regular expressions and YARA rules
• :zzz: Fenrir - Simple Bash IOC Scanner
• Loki - Simple IOC and Incident Response Scanner
• Redline - Free endpoint security tool from FireEye
• THOR Lite - Free IOC and YARA Scanner

Acquisition

• Acquire - Acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
• ALEX - Extract files from ADB devices on Windows, Linux and MacOS. Mostly a wrapper for adbutils.
• Amele - Cross-platform digital forensics tool for local and remote disk, RAM, and mobile evidence acquisition across Windows, Linux, Android, and iOS.
• artifactcollector - A customizable agent to collect forensic artifacts on any Windows, macOS or Linux system
• AVML - A portable volatile memory acquisition tool for Linux
• Belkasoft RAM Capturer - Volatile Memory Acquisition Tool
• DFIR ORC - Forensics artefact collection tool for systems running Microsoft Windows
• :zzz: FastIR Collector - Collect artifacts on windows
• FireEye Memoryze - A free memory forensic software
• FIT - Forensic acquisition of web pages, emails, social media, etc.
• ForensicMiner - A PowerShell-based DFIR automation tool, for artifact and evidence collection on Windows machines.
• Fuji - MacOS forensic acquisition made simple. It creates full file system copies or targeted collection of Mac computers.
• Hypoxia - Cross-platform CLI tool for targeted file collection with SHA-256 manifest, chain-of-custody log, and checkpoint/resume support.
• LiME - Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD
• Magnet RAM Capture / DumpIt - A free imaging tool designed to capture the physical memory
• SPECTR3 - Acquire, triage and investigate remote evidence via portable iSCSI readonly access
• UFADE - Extract files from iOS devices on Linux and MacOS. Mostly a wrapper for pymobiledevice3. Creates iTunes-style backups and advanced logical backups.
• unix_collector - A live forensic collection script for UNIX-like systems as a single script.
• Velociraptor - Velociraptor is a tool for collecting host based state information using Velocidex Query Language (VQL) queries
• WinTriage - Wintriage is a live response tool that extracts Windows artifacts. It must be executed with local or domain administrator privileges and recommended to be done from an external drive.

Imaging

• dc3dd - Improved version of dd
• :zzz: dcfldd - Different improved version of dd (this version has some bugs!, another version is on github adulau/dcfldd)
• FTK Imager - Free imaging tool for windows
• :star: Guymager - Open source version for disk imaging on linux systems

Carving

• bstrings - Improved strings utility
• bulk_extractor - Extracts information such as email addresses, creditcard numbers and histrograms from disk images
• floss - Static analysis tool to automatically deobfuscate strings from malware binaries
• :star: photorec - File carving tool
• :zzz: swap_digger - A bash script used to automate Linux swap analysis, automating swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, etc.

Memory Forensics

• :zzz: inVtero.net - High speed memory analysis framework developed in .NET supports all Windows x64, includes code integrity and write support
• :zzz: KeeFarce - Extract KeePass passwords from memory
• MemProcFS - An easy and convenient way of accessing physical memory as files a virtual file system.
• :package: Rekall - Memory Forensic Framework
• :package: volatility - The memory forensic framework
• VolUtility - Web App for Volatility framework

Network Forensics

• Kismet - A passive wireless sniffer
• NetworkMiner - Network Forensic Analysis Tool
• RustNet - A cross-platform network monitoring terminal UI providing real-time visibility into network connections
• Squey - Logs/PCAP visualization software designed to detect anomalies and weak signals in large amounts of data.
• :star: WireShark - A network protocol analyzer

Windows Artifacts

• :zzz: Beagle - Transform data sources and logs into graphs
• Blauhaunt - A tool collection for filtering and visualizing logon events
• FRED - Cross-platform microsoft registry hive editor
• Hayabusa - A sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
• LastActivityView - LastActivityView by Nirsoftis a tool for Windows operating system that collects information from various sources on a running system, and displays a log of actions made by the user and events occurred on this computer.
• LogonTracer - Investigate malicious Windows logon by visualizing and analyzing Windows event log
• :zzz: python-evt - Pure Python parser for classic Windows Event Log files (.evt)
• RegRipper3.0 - RegRipper is an open source Perl tool for parsing the Registry and presenting it for analysis
• RegRippy - A framework for reading and extracting useful forensics data from Windows registry hives

NTFS/MFT Processing

• MFT-Parsers - Comparison of MFT-Parsers
• MFTEcmd - MFT Parser by Eric Zimmerman
• MFTExtractor - MFT-Parser
• NTFS journal parser
• NTFSTool - Complete NTFS forensics tool
• :zzz: NTFS USN Journal parser
• RecuperaBit - Reconstruct and recover NTFS data
• :zzz: python-ntfs - NTFS analysis

OS X Forensics

• APFS Fuse - A read-only FUSE driver for the new Apple File System
• mac_apt (macOS Artifact Parsing Tool) - Extracts forensic artifacts from disk images or live machines
• :zzz: MacLocationsScraper - Dump the contents of the location database files on iOS and macOS
• :zzz: macMRUParser - Python script to parse the Most Recently Used (MRU) plist files on macOS into a more human friendly format
• :zzz: OSXAuditor
• :package: OSX Collect

Mobile Forensics

• :zzz: Andriller - A software utility with a collection of forensic tools for smartphones
• ALEAPP - An Android Logs Events and Protobuf Parser
• ArtEx - Artifact Examiner for iOS Full File System extractions
• iLEAPP - An iOS Logs, Events, And Plists Parser
• :zzz: iOS Frequent Locations Dumper - Dump the contents of the StateModel#.archive files located in /private/var/mobile/Library/Caches/com.apple.routined/
• :zzz: MEAT - Perform different kinds of acquisitions on iOS devices
• MobSF - An automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
• :zzz: OpenBackupExtractor - An app for extracting data from iPhone and iPad backups.

Docker Forensics

• :zzz: dof (Docker Forensics Toolkit) - Extracts and interprets forensic artifacts from disk images of Docker Host systems
• :package: Docker Explorer - Extracts and interprets forensic artifacts from disk images of Docker Host systems

Internet Artifacts

• ChromeCacheView - A small utility that reads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache
• hindsight - Internet history forensics for Google Chrome/Chromium
• IE10Analyzer - This tool can parse normal records and recover deleted records in WebCacheV01.dat.
• unfurl - Extract and visualize data from URLs
• WinSearchDBAnalyzer - This tool can parse normal records and recover deleted records in Windows.edb.

Timeline Analysis

• DFTimewolf - Framework for orchestrating forensic collection, processing and data export using GRR and Rekall
• :star: plaso - Extract timestamps from various files and aggregate them
• Timeline Explorer - Timeline Analysis tool for CSV and Excel files. Built for SANS FOR508 students
• timeliner - A rewrite of mactime, a bodyfile reader
• timesketch - Collaborative forensic timeline analysis

Disk image handling

• Disk Arbitrator - A Mac OS X forensic utility designed to help the user ensure correct forensic procedures are followed during imaging of a disk device
• :zzz: imagemounter - Command line utility and Python package to ease the (un)mounting of forensic disk images
• libewf - Libewf is a library and some tools to access the Expert Witness Compression Format (EWF, E01)
• xmount - Convert between different disk image formats

Decryption

• hashcat - Fast password cracker with GPU support
• John the Ripper - Password cracker

Management

• Catalyst - Catalyst is an open source security automation and ticket system
• dfirtrack - Digital Forensics and Incident Response Tracking application, track systems
• iris - Collaborative Incident Response platform

Picture Analysis

• :zzz: Ghiro - A fully automated tool designed to run forensics analysis over a massive amount of images
• sherloq - An open-source digital photographic image forensic toolset

Metadata Forensics

• ExifTool by Phil Harvey
• :zzz: FOCA - FOCA is a tool used mainly to find metadata and hidden information in the documents
• :zzz: Metagoofil - Metadata harvester for extracting metadata from public documents
• mat2 - Metadata removal tool, supporting a wide range of commonly used file formats
• oletools - Tools to analyze Microsoft OLE2 files and MS Office documents for malware analysis and forensics
• pdf-parser - Parse and analyze PDF files to extract metadata and identify malicious content

Steganography

• Sonicvisualizer
• :zzz: Steghide - is a steganography program that hides data in various kinds of image and audio files
• Zsteg - Detect steganography hidden in PNG and BMP files

Learn Forensics

• Forensic challenges - Mindmap of forensic challenges

CTFs and Challenges

• BelkaCTF - CTFs by Belkasoft
• CyberDefenders
• DefCon CTFs - archive of DEF CON CTF challenges.
• Forensics CTFs
• MagnetForensics CTF Challenge
• MalwareTech Labs
• :zzz: MemLabs
• NW3C Chanllenges
• Precision Widgets of North Dakota Intrusion
• ReverseEngineering Challenges

Resources

Web

• ForensicsFocus
• SANS Digital Forensics
• Forensics StartMe by Stark 4N6

Blogs

• Netresec
• SANS Forensics Blog
• SecurityAffairs - blog by Pierluigi Paganini
• This Week In 4n6 - Weekly updates for forensics
• Zena Forensics

Books

more at Recommended Readings by Andrew Case

• Network Forensics: Tracking Hackers through Cyberspace - Learn to recognize hackers’ tracks and uncover network-based evidence
• The Art of Memory Forensics - Detecting Malware and Threats in Windows, Linux, and Mac Memory
• The Practice of Network Security Monitoring - Understanding Incident Detection and Response

File System Corpora

• Digital Forensic Challenge Images - Two DFIR challenges with images
• Digital Forensics Tool Testing Images

Other

• /r/computerforensics/ - Subreddit for computer forensics
• CybersecurityGuide – Digital Forensics Careers - Guide on skills, certs, and career paths in cyber forensics.
• ForensicPosters - Posters of file system structures
• SANS Posters - Free posters provided by SANS

Labs

• BlueTeam.Lab - Blue Team detection lab created with Terraform and Ansible in Azure.

Related Awesome Lists

• Android Security
• AppSec
• CTFs
• Hacking
• Honeypots
• Incident-Response
• Infosec
• Malware Analysis
• Pentesting
• Reverse Engineering & Malware Analysis
• Security
• Social Engineering
• YARA

Contributing

Pull requests and issues with suggestions are welcome!