A list of free and open source forensics analysis tools and other resources.
Collections
Challenges
Distributions
- bitscout - LiveCD/LiveUSB for remote forensic acquisition and analysis
- CAINE
- dfnix - Bootable forensic NixOS live environment featuring declarative hardware write-blocking by default, forensic storage mounters, and network triage tooling.
- GRML-Forensic
- Remnux - Distro for reverse-engineering and analyzing malicious software
- ⭐SANS Investigative Forensics Toolkit (sift) - Linux distribution for forensic analysis
- Santoku Linux - Santoku is dedicated to mobile forensics, analysis, and security, and packaged in an easy to use, Open Source platform.
- Sumuri Paladin - Linux distribution that simplifies various forensics tasks in a forensically sound manner via the PALADIN Toolbox
- Tsurugi Linux - Linux distribution for forensic analysis
- WinFE - Windows Forensics enviroment
- Predator OS - Linux distribution for forensic analysis
Frameworks
- ⭐Autopsy - SleuthKit GUI
- dff - Forensic framework
- dexter - Dexter is a forensics acquisition framework designed to be extensible and secure
- IntelMQ - IntelMQ collects and processes security feeds
- Kuiper - Digital Investigation Platform
- Laika BOSS - Laika is an object scanner and intrusion detection system
- RegRippy - is a framework for reading and extracting useful forensics data from Windows registry hives.
- PowerForensics - PowerForensics is a framework for live disk forensic analysis
- ⭐ The Sleuth Kit - Tools for low level forensic analysis
- turbinia - Turbinia is an open-source framework for deploying, managing, and running forensic workloads on cloud platforms
- IPED - Indexador e Processador de Evidências Digitais - Brazilian Federal Police Tool for Forensic Investigations
Live forensics
- grr - GRR Rapid Response: remote live forensics for incident response
- Linux Expl0rer - Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask
- mig - Distributed & real time digital forensics at the speed of the cloud
- osquery - SQL powered operating system analytics
Acquisition
- artifactcollector - A customizable agent to collect forensic artifacts on any Windows, macOS or Linux system
- ArtifactExtractor - Extract common Windows artifacts from source images and VSCs
- AVML - A portable volatile memory acquisition tool for Linux
- DFIR ORC - Forensics artefact collection tool for systems running Microsoft Windows
- DumpIt -
- FastIR Collector - Collect artifacts on windows
- FireEye Memoryze
- Fuji - Graphical interface for the forensic logical acquisition of Mac computers
- LiME - Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD
- Magnet RAM Capture - is a free imaging tool designed to capture the physical memory
- ⭐RAM Capturer - by Belkasoft is a free tool to dump the data from a computer’s volatile memory. It’s compatible with Windows OS.
- UFADE - Extract files from Apple devices on Windows, Linux and MacOS. Mostly a wrapper for pymobiledevice3. Creates iTunes-style backups and "advanced logical backups"
- Velociraptor - Velociraptor is a tool for collecting host based state information using Velocidex Query Language (VQL) queries
Imageing
- ⭐BelkaImager - by Belkasoft allows you to create images of hard and removable disks, Android and iOS devices and download data from the cloud.
- dc3dd - Improved version of dd
- dcfldd - Different improved version of dd (this version has some bugs!, another version is on github adulau/dcfldd)
- dfdisk - Modern forensic disk imaging and damaged media rescue TUI/CLI supporting E01 (Expert Witness Format) and RAW with on-the-fly multi-hash verification (MD5/SHA1/SHA256) and hardware write-block guardrails.
- FTK Imager - Free imageing tool for windows
- ⭐Guymager - Open source version for disk imageing on linux systems
Carving
- bstrings - Improved strings utility
- bulk_extractor - Extracts informations like email adresses, creditscard numbers and histrograms of disk images
- floss - Static analysis tool to automatically deobfuscate strings from malware binaries
- ⭐ photorec - File carving tool
- swap_digger - A bash script used to automate Linux swap analysis, automating swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, etc.
Memory Forensics
- FireEye RedLine - provides host investigative capabilities to users to find signs of malicious activity through memory and file analysis and the development of a threat assessment profile.
- inVtero.net - High speed memory analysis framework
developed in .NET supports all Windows x64, includes code integrity and write support
- KeeFarce - Extract KeePass passwords from memory
- MemProcFS - An easy and convenient way of accessing physical memory as files a virtual file system.
- MemPrcFs Analyzer - PowerShell script utilized to simplify the usage of MemProcFS and to optimize your memory analysis workflow.
- Rekall - Memory Forensic Framework
- ⭐volatility - The memory forensic framework
- VolUtility - Web App for Volatility framework
Network Forensics
Windows Artifacts
- Beagle - Transform data sources and logs into graphs
- CrowdResponse - by CrowdStrike is a static host data collection tool
- FRED - Cross-platform microsoft registry hive editor
- LastActivityView - LastActivityView by Nirsoftis a tool for Windows operating system that collects information from various sources on a running system, and displays a log of actions made by the user and events occurred on this computer.
- LogonTracer - Investigate malicious Windows logon by visualizing and analyzing Windows event log
- python-evt - Pure Python parser for classic Windows Event Log files (.evt)
- RegRipper3.0 - RegRipper is an open source Perl tool for parsing the Registry and presenting it for analysis.
NTFS/MFT Processing
Linux Forensics
-FJTA - Forensic Journal Timeline Analyzer - Tool that analyzes Linux filesystem (ext4, XFS) journals (not systemd-journald logs), generates timelines, and detects suspicious activities
OS X Forensics
Mobile Forensics
- Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices
- ALEAPP - An Android Logs Events and Protobuf Parser
- iOS Frequent Locations Dumper - Dump the contents of the StateModel#.archive files located in /private/var/mobile/Library/Caches/com.apple.routined/
- MEAT - Perform different kinds of acquisitions on iOS devices
- MobSF - is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
- OpenBackupExtractor - is an app for extracting data from iPhone and iPad backups.
Docker Forensics
Browser Artifacts
- ChromeCacheView - by Nirsoft is a small utility that reads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache
- chrome-url-dumper - Dump all local stored infromation collected by Chrome
- Dumpzilla - extract all forensic interesting information of Firefox, Iceweasel and Seamonkey browsers
- hindsight - Internet history forensics for Google Chrome/Chromium
- unfurl - Extract and visualize data from URLs
- mozdmp - Offline profile decryption tool for Mozilla Firefox. Supports multi-core CPU-based cracking of the master password and the latest Firefox hash formats, including those not yet supported by Hashcat and JTR.
- chrdmp - Decrypt Chrome profile data offline using the Chrome Safe Storage keyring secret.
Timeline Analysis
- DFTimewolf - Framework for orchestrating forensic collection, processing and data export using GRR and Rekall
- ⭐ plaso - Extract timestamps from various files and aggregate them
- timeliner - A rewrite of mactime, a bodyfile reader
- timesketch - Collaborative forensic timeline analysis
Disk image handling
- Disk Arbitrator - A Mac OS X forensic utility designed to help the user ensure correct forensic procedures are followed during imaging of a disk device
- imagemounter - Command line utility and Python package to ease the (un)mounting of forensic disk images
- libewf - Libewf is a library and some tools to access the Expert Witness Compression Format (EWF, E01)
- OSFMount - allows you to mount local disk image files (bit-for-bit copies of an entire disk or disk partition) in Windows as a physical disk or a logical drive
- PancakeViewer - Disk image viewer based in dfvfs, similar to the FTK Imager viewer.
- xmount - Convert between different disk image formats
Decryption
Management
- dfirtrack - Digital Forensics and Incident Response Tracking application, track systems
- Incidents - Web application for organizing non-trivial security investigations. Built on the idea that incidents are trees of tickets, where some tickets are leads
Picture Analysis
- Ghiro - is a fully automated tool designed to run forensics analysis over a massive amount of images
- sherloq - An open-source digital photographic image forensic toolset
Steganography
- Binwalk - Binwalk is a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images.
- Foremost - is a program to recover files based on their headers and footers
- Sonicvisualizer
- Steghide - is a steganography program that hides data in various kinds of image and audio files
- Stegsolve - analyze images in different planes by taking off bits of the image
- Wavsteg - is a steganography program that hides data in various kinds of image and audio files
- Zsteg - A steganographic coder for WAV files
- Audacity - an easy-to-use, multi-track audio editor and recorder
- ExifTool by Phil Harvey
- Exiv2 - Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata
- FOCA - FOCA is a tool used mainly to find metadata and hidden information in the documents
Website Forensics
- Freezing Internet Tool - Python 3 application for forensic acquisition of online content, including web pages, emails, and social media.
- ScanMalware - Scan websites for malicious behaviours and fingerprint JavaScripts.
Learn forensics
Challenges
Resources
Webs
Blogs
Books
more at Recommended Readings by Andrew Case
File System Corpora
Other
