Tools

This page will serve as a curated list of DFIR related Tools.

Tool	Developer(s)	Category	Description
ALEAPP	Alexis Brignoni	Mobile Forensics	Android Logs Events And Protobuf Parser.
ALFA	Invictus Incident Response	Cloud & SaaS	ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit logs and to perform automated forensic analysis on the audit logs using statistics and the MITRE ATT&CK Cloud Framework.
Arsenal Image Mounter	Arsenal Recon	Utilities	Arsenal Image Mounter mounts the contents of disk images as complete disks in Windows, allowing users to benefit from disk-specific features like integration with Disk Manager, launching virtual machines (and then bypassing Windows authentication and DPAPI), managing BitLocker-protected volumes, mounting Volume Shadow Copies, and more.
BMC-Tools	ANSSI	Digital Forensics	RDP Bitmap Cache parser.
Aurora Incident Response	Mathias Fuchs	Incident Response	Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders.
Belkasoft X Corporate	Belkasoft	Digital Forensics	Protect your business assets from malware and hacking attempts, perform cyber incident investigations and incident response, comply with legal requirements and regulations in eDiscovery, respond to insider threats, fight cyberharassment and bullying in the workplace.
Belkasoft X Forensic	Belkasoft	Digital Forensics	Belkasoft X Forensic is the complete solution for conducting in-depth investigations on all types of digital media devices and data sources, including computers, mobile devices, RAM, drones, car images, and the cloud.
Belkasoft Remote Acquisition	Belkasoft	Data Acquisition	Digital forensic and incident response tool developed specifically for remote extraction.
Belkasoft Incident Investigations	Belkasoft	Triage	Efficiently investigate hacking attempts of Windows computers.
Belkasoft Triage	Belkasoft	Triage	Perform effective triage analysis of Windows devices right on the incident scene.
Belkasoft RAM Capturer: Volatile Memory Acquisition Tool	Belkasoft	Data Acquisition	Belkasoft Live RAM Capturer is a tiny free forensic tool that allows to reliably extract the entire contents of computer’s volatile memory—even if protected by an active anti-debugging or anti-dumping system.
Blue Team App Office 365 and Azure	Invictus Incident Response	Cloud & SaaS	The Blue team app for Office 365 and Azure is developed to help you investigate the Microsoft 365 Audit log.
Autopsy	Brian Carrier	Digital Forensics	Autopsy is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools.
The Sleuth Kit	Brian Carrier	Digital Forensics	The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate disk images. The core functionality of TSK allows you to analyze volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
bulk_extractor	Dr. Simson Garfinkel	Digital Forensics	bulk_extractor is a high-performance digital forensics exploitation tool. It is a "get evidence" button that rapidly scans any kind of input (disk images, files, directories of files, etc) and extracts structured information such as email addresses, credit card numbers, JPEGs and JSON snippets without parsing the file system or file system structures.
Chainsaw	WithSecureLabs	Triage	Rapidly Search and Hunt through Windows Forensic Artefacts.
Cellebrite Digital Collector	Cellebrite	Data Acquisition	A powerful forensic imaging software solution to perform triage, live data acquisition and targeted data collection for Windows and Mac computers.
Cellebrite Inspector	Cellebrite	Digital Forensics	All the functionality you need to conduct in-depth analysis and generate custom reports to reveal the truth.
Cellebrite Physical Analyzer	Cellebrite	Digital Forensics	Surface actionable intelligence from the broadest range of digital devices, applications, warrant returns and the Cloud, to work smarter and faster.
Cellebrite UFED	Cellebrite	Data Acquisition	Collect data from the widest range of digital devices.
cLeapp	Mark McKinnon	Triage	Chrome Logs Events and Protobuf Parser.
CyLR	Alan Orlikoski & Jason Yegge	Triage	CyLR - Live Response Collection Tool.
Cyber Triage	Brian Carrier	Triage	Cyber Triage is automated Digital Forensics and Incident Response (DFIR) software that allows cybersecurity professionals like you to quickly answer intrusion questions related to malware, ransomware, and account takeover.
FTK Forensic Toolkit	Exterro	Digital Forensics	The gold standard in digital forensics software for repeatable, defensible full-disk image collection, processing and review.
DFIR-IRIS	DFIR-IRIS	Incident Response	IRIS is a collaborative platform aiming to help incident responders to share technical details during investigations.
Directory OPUS	GP Software	Utilities	Directory Opus is a complete replacement for Explorer, with far more functionality than any other file manager available today.
DriveFS Sleuth	Amged Wageh	Cloud & SaaS	DriveFS Sleuth is a Python tool that automates investigating Google Drive File Stream disk artifacts, the tool has been developed based on research that has been performed by mounting different scenarios and noting down the changes in the Google Drive File Stream disk artifacts.
EditPad Pro	Just Great Software	Utilities	EditPad Pro is a powerful and versatile text editor or word processor.
Browser History Viewer	Foxtron Forensics	Digital Forensics	Browser History Viewer allows you to easily view internet history from the main desktop web browsers.
Eric Zimmerman's Tools	Eric Zimmerman	Triage	Eric Zimmerman's suite of forensic tools which includes artifact parsing tools and GUIs for raw artifact analysis.
Event Log Explorer	FSPro Labs	Windows Artifact Analysis	Event Log Explorer is an effective software solution for viewing, analyzing and monitoring events recorded in Microsoft Windows event logs.
EventTranscriptParser	Abhiram Kumar Patiballa	Windows Artifact Analysis	Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data).
Everything	Voidtools	Utilities	Locate files and folders by name instantly.
F-Response	F-Response	Data Acquisition	Live forensics, data recovery and eDiscovery over an IP network - using your choice of tools.
Flare-VM	Mandiant	Malware Analysis	A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
MAGNET Axiom	MAGNET Forensics	Digital Forensics	Examine digital evidence from mobile, cloud, computer, and vehicle sources, alongside third-party extractions all in one case file.
FTK Imager	Exterro	Data Acquisition	FTK Imager is a data preview and imaging tool used to acquire digital evidence in a forensically sound manner by creating copies of data without changing the original in any way.
GAM	Jay Lee	Cloud & SaaS	GAM is a command line tool for Google Workspace admins to manage domain and user settings quickly and easily.
Hayabusa	Yamamoto Security	Triage	Hayabusa is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Hibernation Recon	Arsenal Recon	Utilities	Hibernation Recon not only supports active memory reconstruction from Windows XP, Vista, 7, 8/8.1, 10, and 11 hibernation files, but also extracts massive volumes of information from the multiple types (and levels) of slack space that may exist within them.
EnCase Forensic	OpenText	Digital Forensics	EnCase Forensic is the global standard in digital investigation technology for forensic practitioners who need to conduct efficient, forensically-sound data collection and investigations using a repeatable and defensible process.
INDXRipper	Harel Segev	Windows Artifact Analysis	Carve file metadata from NTFS index ($I30) attributes.
iLEAPP	Alexis Brignoni	Mobile Forensics	iOS Logs, Events, And Plist Parser.
Invictus-AWS	Invictus Incident Response	Cloud & SaaS	A tool for AWS incident response, that allows for enumeration, acquisition and analysis of data from AWS environments for the purpose of incident response.
Kansa	Dave Hull	Incident Response	A Powershell incident response framework.
KAPE	Eric Zimmerman	Triage	Kroll Artifact Parser and Extractor (KAPE) is an efficient and highly configurable triage program that will target essentially any device or storage location, find forensically useful artifacts, and parse them within a few minutes.
lLeapp	Mark McKinnon	Triage	Linux Logs Events Application Program Parser.
MAGNET Acquire	MAGNET Forensics	Data Acquisition	Magnet Acquire lets digital forensic examiners quickly and easily acquire forensic images of any iOS or Android device, hard drive, and removable media — and is available at no cost to the forensic community.
SIFT Workstation	Rob Lee	Digital Forensics	The SIFT Workstation is a collection of free and open-source incident response and forensic tools designed to perform detailed digital forensic examinations in a variety of settings.
MAGNET DumpIt for Linux	MAGNET Forensics	Data Acquisition	Memory acquisition for Linux that makes sense.
MAGNET DumpIt for Windows	MAGNET Forensics	Data Acquisition	DumpIt is a fast memory acquisition tool for Windows (x86, x64, ARM64). Generate full memory crash dumps of Windows machines.
MAGNET Process Capture	MAGNET Forensics	Data Acquisition	Magnet Process Capture is a free tool that allows you to capture memory from individual running processes.
MAGNET RAM Capture	MAGNET Forensics	Data Acquisition	Magnet RAM Capture is a free imaging tool designed to capture the physical memory of a suspect’s computer, allowing investigators to recover and analyze valuable artifacts that are often only found in memory.
mboxviewer	eneam	Cloud & SaaS	A simple viewer to view mbox files such as Thunderbird Archives, Google mail archives or simple Eml files.
MemProcFS	Ulf Frisk	Memory Forensics	MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system.
MFT_Browser	Costas Katsavounidis	Windows Artifact Analysis	$MFT directory tree reconstruction & FILE record info.
Mft2Csv	Jörg Schicht	Windows Artifact Analysis	Extract $MFT record info and log it to a csv file.
Microsoft Extractor Suite	Invictus Incident Response	Cloud & SaaS	A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
NirSoft	NirSoft	Triage	NirSoft's Forensics utilities suite.
OneDriveExplorer	Brian Maloney	Cloud & SaaS	OneDriveExplorer is a command line and GUI based application for reconstructing the folder structure of OneDrive from the .dat and .dat.previous file.
PCAParser	Andrew Rathbun	Windows Artifact Analysis	A PowerShell script that can be used to parse and convert to CSV the new Windows 11 artifacts found in C:\Windows\appcompat\pca.
Plaso	Kristinn Guðjónsson	Timeline Analysis	Plaso, or super timeline all the things, is a Python-based engine used by several tools for automatic creation of timelines.
PowerToys	Microsoft	Utilities	Microsoft PowerToys is a set of utilities for power users to tune and streamline their Windows experience for greater productivity.
Rapid Endpoint Investigations	Secure Cake	Triage	Scripts for rapid Windows endpoint "tactical triage" and investigations with Velociraptor and KAPE.
RDPCacheStitcher	Adam Harrison	Windows Artifact Analysis	RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.
reg_hunter	The Flakes	Triage	Blueteam operational triage registry hunting/forensic tool.
RegRipper	Harlen Carvey	Windows Artifact Analysis	Open-source tool, written in Perl, for extracting/parsing information (key, values, data) from the registry and presenting it for analysis.
Regshot	Para and TiANWEi	Windows Artifact Analysis	Regshot is a small, free and open-source registry compare utility that allows you to quickly take a snapshot of your registry and then compare it with a second one - done after doing system changes or installing a new software product.
REMnux	Lenny Zeltser	Malware Analysis	A Linux Toolkit for Malware Analysis.
RLEAPP	Alexis Brignoni	Triage	Returns Logs Events And Properties Parser.
ShareX	Jaex	Utilities	Screen capture, file sharing and productivity tool.
Hindsight	Ryan Benson	Digital Forensics	Web browser forensics for Google Chrome/Chromium.
Snagit	Techsmith	Utilities	The ultimate screen capture & video recording tool for Windows and Mac.
SOF-ELK	Phil Hagen	Incident Response	SOF-ELK is a “big data analytics” platform focused on the typical needs of computer forensic investigators/analysts and information security operations personnel.
TZworks	TZWorks	Digital Forensics	Suite of forensic tools that either (a) simplify the investigative process, (b) provide new automated capabilities where only manual techniques were available or (c) reverse engineer a new aspect of the operating system to give new artifact analysis capabilities where none existed before.
THOR APT Scanner	Nextron Systems	Triage	THOR is the most sophisticated and flexible compromise assessment tool on the market.
THOR Lite Free IOC and YARA Scanner	Nextron Systems	Triage	THOR Lite includes the file system and process scan module as well as module that extracts “autoruns” information on the different platforms.
Thumbcache Viewer	Eric Zimmerman	Windows Artifact Analysis	Thumbcache Viewer allows you to extract thumbnail images from the thumbcache_*.db and iconcache_*.db database files found on Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, and Windows 11.
Thumbs Viewer	Jan Libicek	Windows Artifact Analysis	Thumbs Viewer allows you to extract thumbnail images from the Thumbs.db, ehthumbs.db, ehthumbs_vista.db, Image.db, Video.db, TVThumb.db, and musicThumbs.db database files found on various Windows operating systems.
Timesketch	Johan Berggren	Timeline Analysis	Timesketch is an open-source tool for collaborative forensic timeline analysis.
TRACE	Radoslav Gadzhovski	Windows Artifact Analysis	TRACE is a digital forensic analysis tool that provides a user-friendly interface for investigating disk images.
DB Browser for SQLite	Various	Digital Forensics	DB Browser for SQLite (DB4S) is a high quality, visual, open source tool designed for people who want to create, search, and edit SQLite database files.
UAC	Thiago Canozzo Lahr	Triage	UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.
unix_collector	Jerzy 'Yuri' Kramarz	Triage	unix_collector is a Live Response collection script for Incident Response on UNIX-like systems using native binaries.
USB Detective	Jason Hale	Windows Artifact Analysis	USB Detective is an application for identifying, investigating, and reporting on USB storage devices that have been connected to a Windows system.
Usnjrnl Rewind	CyberCX	Windows Artifact Analysis	This script will process the outputs of Eric Zimmerman's MFTEcmd tool and produce a csv that has the complete and correct path for every file and folder (no more Unknowns).
Velociraptor	Velocidex	Incident Response	Velociraptor is an advanced digital forensic and incident response tool that enhances your visibility into your endpoints.
Volatility 2	Volatility Foundation	Memory Forensics	Volatility is the world's most widely used framework for extracting digital artifacts from volatile memory (RAM) samples.
Volatility 3	Volatility Foundation	Memory Forensics	Volatility is the world's most widely used framework for extracting digital artifacts from volatile memory (RAM) samples.
Volatility Workbench	PassMark Software	Memory Forensics	Volatility Workbench is a graphical user interface (GUI) for the Volatility tool. Volatility is a command line memory analysis and forensics tool for extracting artifacts from memory dumps. Volatility Workbench is free, open source and runs in Windows.
VLEAPP	Alexis Brignoni	Triage	Vehicle Logs Events And Properties Parser.
Wazuh	Wazuh, Inc.	Incident Response	Unified XDR and SIEM protection for endpoints and cloud workloads.
WELA	Yamamoto Security	Timeline Analysis	WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs!
WinFE	Troy Larson	Utilities	Windows Forensic Environment, also known as WinFE or Windows FE, was originally developed by Troy Larson, Senior Forensic Manager, Microsoft Corporation, by simply adding two registry keys to the Windows Vista Pre-installation Environment 2.0 (WinPE 2.0). These keys prevented the auto-mounting of some of the volumes at boot time, which then allowed the creation of a rudimentary Microsoft Windows based forensic boot CD/DVD or USB Device.
WinPmem	Velocidex	Memory Forensics	The multi-platform memory acquisition tool.
WMI-Parser	Mark Woan	Windows Artifact Analysis	Parses the WMI object database....looking for persistence.
X-Ways Forensics	X-Ways	Digital Forensics	X-Ways Forensics is an advanced work environment for computer forensic examiners and the flagship product.
X-Ways Imager	X-Ways	Data Acquisition	Forensic disk imaging tool. Stripped down version of the X-Ways Forensics computer forensics software with just the disk imaging functionality and little more.