Tools

This page will serve as a curated list of DFIR related Tools.

Tool	Developer(s)	Category	Description
ALEAPP	Alexis Brignoni	Android	Android Logs Events And Protobuf Parser.
ALFA	Invictus Incident Response	Google Workspace	ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit logs and to perform automated forensic analysis on the audit logs using statistics and the MITRE ATT&CK Cloud Framework.
Arsenal Image Mounter	Arsenal Recon	Windows	Arsenal Image Mounter mounts the contents of disk images as complete disks in Windows, allowing users to benefit from disk-specific features like integration with Disk Manager, launching virtual machines (and then bypassing Windows authentication and DPAPI), managing BitLocker-protected volumes, mounting Volume Shadow Copies, and more.
Autopsy	Brian Carrier	Various	Autopsy is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools.
Aurora Incident Response	Mathias Fuchs	Documentation	Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders.
Belkasoft X Forensic	Belkasoft	Various	Belkasoft X Forensic is the complete solution for conducting in-depth investigations on all types of digital media devices and data sources, including computers, mobile devices, RAM, drones, car images, and the cloud.
Belkasoft X Corporate	Belkasoft	Various	Protect your business assets from malware and hacking attempts, perform cyber incident investigations and incident response, comply with legal requirements and regulations in eDiscovery, respond to insider threats, fight cyberharassment and bullying in the workplace.
Belkasoft Remote Acquisition	Belkasoft	Various	Digital forensic and incident response tool developed specifically for remote extraction.
Belkasoft Incident Investigations	Belkasoft	Windows	Efficiently investigate hacking attempts of Windows computers.
Belkasoft Incident Investigations	Belkasoft	Windows	Perform effective triage analysis of Windows devices right on the incident scene.
Belkasoft RAM Capturer: Volatile Memory Acquisition Tool	Belkasoft	Memory	Belkasoft Live RAM Capturer is a tiny free forensic tool that allows to reliably extract the entire contents of computer’s volatile memory—even if protected by an active anti-debugging or anti-dumping system.
Blue Team App Office 365 and Azure	Invictus Incident Response	M365	The Blue team app for Office 365 and Azure is developed to help you investigate the Microsoft 365 Audit log.
BMC-Tools	ANSSI	Windows	RDP Bitmap Cache parser.
Browser History Viewer	Foxtron Forensics	Various	Browser History Viewer allows you to easily view internet history from the main desktop web browsers.
bulk_extractor	Dr. Simson Garfinkel	Various	bulk_extractor is a high-performance digital forensics exploitation tool. It is a "get evidence" button that rapidly scans any kind of input (disk images, files, directories of files, etc) and extracts structured information such as email addresses, credit card numbers, JPEGs and JSON snippets without parsing the file system or file system structures.
Chainsaw	WithSecureLabs	Windows	Rapidly Search and Hunt through Windows Forensic Artefacts.
Cellebrite Digital Collector	Cellebrite	Various	A powerful forensic imaging software solution to perform triage, live data acquisition and targeted data collection for Windows and Mac computers.
Cellebrite Inspector	Cellebrite	Various	All the functionality you need to conduct in-depth analysis and generate custom reports to reveal the truth.
Cellebrite Physical Analyzer	Cellebrite	Various	Surface actionable intelligence from the broadest range of digital devices, applications, warrant returns and the Cloud, to work smarter and faster.
Cellebrite UFED	Cellebrite	Various	Collect data from the widest range of digital devices.
cLeapp	Mark McKinnon	Google Workspace	Chrome Logs Events and Protobuf Parser.
CyLR	Alan Orlikoski & Jason Yegge	Various	CyLR - Live Response Collection Tool.
Cyber Triage	Brian Carrier	Windows	Cyber Triage is automated Digital Forensics and Incident Response (DFIR) software that allows cybersecurity professionals like you to quickly answer intrusion questions related to malware, ransomware, and account takeover.
DB Browser for SQLite	Various	Various	DB Browser for SQLite (DB4S) is a high quality, visual, open source tool designed for people who want to create, search, and edit SQLite database files.
DFIR-IRIS	DFIR-IRIS	Documentation	IRIS is a collaborative platform aiming to help incident responders to share technical details during investigations.
Directory OPUS	GP Software	Productivity	Directory Opus is a complete replacement for Explorer, with far more functionality than any other file manager available today.
DriveFS Sleuth	Amged Wageh	Google Workspace	DriveFS Sleuth is a Python tool that automates investigating Google Drive File Stream disk artifacts, the tool has been developed based on research that has been performed by mounting different scenarios and noting down the changes in the Google Drive File Stream disk artifacts.
EditPad Pro	Just Great Software	Productivity	EditPad Pro is a powerful and versatile text editor or word processor.
EnCase Forensic	OpenText	Various	EnCase Forensic is the global standard in digital investigation technology for forensic practitioners who need to conduct efficient, forensically-sound data collection and investigations using a repeatable and defensible process.
Eric Zimmerman's Tools	Eric Zimmerman	Windows	Eric Zimmerman's suite of forensic tools which includes artifact parsing tools and GUIs for raw artifact analysis.
Event Log Explorer	FSPro Labs	Windows	Event Log Explorer is an effective software solution for viewing, analyzing and monitoring events recorded in Microsoft Windows event logs.
EventTranscriptParser	Abhiram Kumar Patiballa	Windows	Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data).
Everything	Voidtools	Other	Locate files and folders by name instantly.
F-Response	F-Response	Various	Live forensics, data recovery and eDiscovery over an IP network - using your choice of tools.
Flare-VM	Mandiant	Malware	A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
FTK Forensic Toolkit	Exterro	Various	The gold standard in digital forensics software for repeatable, defensible full-disk image collection, processing and review.
FTK Imager	Exterro	Various	FTK Imager is a data preview and imaging tool used to acquire digital evidence in a forensically sound manner by creating copies of data without changing the original in any way.
GAM	Jay Lee	Google Workspace	GAM is a command line tool for Google Workspace admins to manage domain and user settings quickly and easily.
Hayabusa	Yamamoto Security	Windows	Hayabusa is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Hibernation Recon	Arsenal Recon	Windows	Hibernation Recon not only supports active memory reconstruction from Windows XP, Vista, 7, 8/8.1, 10, and 11 hibernation files, but also extracts massive volumes of information from the multiple types (and levels) of slack space that may exist within them.
Hindsight	Ryan Benson	Various	Web browser forensics for Google Chrome/Chromium.
INDXRipper	Harel Segev	Windows	Carve file metadata from NTFS index ($I30) attributes.
iLEAPP	Alexis Brignoni	iOS	iOS Logs, Events, And Plist Parser.
Kansa	Dave Hull	Various	A Powershell incident response framework.
KAPE	Eric Zimmerman	Windows	Kroll Artifact Parser and Extractor (KAPE) is an efficient and highly configurable triage program that will target essentially any device or storage location, find forensically useful artifacts, and parse them within a few minutes.
lLeapp	Mark McKinnon	Linux	Linux Logs Events Application Program Parser.
MAGNET Acquire	MAGNET Forensics	Various	Magnet Acquire lets digital forensic examiners quickly and easily acquire forensic images of any iOS or Android device, hard drive, and removable media — and is available at no cost to the forensic community.
MAGNET Axiom	MAGNET Forensics	Various	Examine digital evidence from mobile, cloud, computer, and vehicle sources, alongside third-party extractions all in one case file.
MAGNET DumpIt for Linux	MAGNET Forensics	Memory	Memory acquisition for Linux that makes sense.
MAGNET DumpIt for Windows	MAGNET Forensics	Memory	DumpIt is a fast memory acquisition tool for Windows (x86, x64, ARM64). Generate full memory crash dumps of Windows machines.
MAGNET Process Capture	MAGNET Forensics	Memory	Magnet Process Capture is a free tool that allows you to capture memory from individual running processes.
MAGNET RAM Capture	MAGNET Forensics	Memory	Magnet RAM Capture is a free imaging tool designed to capture the physical memory of a suspect’s computer, allowing investigators to recover and analyze valuable artifacts that are often only found in memory.
mboxviewer	eneam	Various	A simple viewer to view mbox files such as Thunderbird Archives, Google mail archives or simple Eml files.
MemProcFS	Ulf Frisk	Memory	MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system.
MFT_Browser	Costas Katsavounidis	Windows	$MFT directory tree reconstruction & FILE record info.
Mft2Csv	Jörg Schicht	Windows	Extract $MFT record info and log it to a csv file.
Microsoft Extractor Suite	Invictus Incident Response	M365	A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
NirSoft	NirSoft	Windows	NirSoft's Forensics utilities suite.
OneDriveExplorer	Brian Maloney	M365	OneDriveExplorer is a command line and GUI based application for reconstructing the folder structure of OneDrive from the .dat and .dat.previous file.
Plaso	Kristinn Guðjónsson	Various	Plaso, or super timeline all the things, is a Python-based engine used by several tools for automatic creation of timelines.
PowerToys	Microsoft	Productivity	Microsoft PowerToys is a set of utilities for power users to tune and streamline their Windows experience for greater productivity.
RDPCacheStitcher	Adam Harrison	Windows	RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.
RegRipper	Harlen Carvey	Windows	Open-source tool, written in Perl, for extracting/parsing information (key, values, data) from the registry and presenting it for analysis.
Regshot	Para and TiANWEi	Windows	Regshot is a small, free and open-source registry compare utility that allows you to quickly take a snapshot of your registry and then compare it with a second one - done after doing system changes or installing a new software product.
REMnux	Lenny Zeltser	Malware
RLEAPP	Alexis Brignoni	Other	Returns Logs Events And Properties Parser.
ShareX	Jaex	Productivity	Screen capture, file sharing and productivity tool.
SIFT Workstation	Rob Lee	Various	The SIFT Workstation is a collection of free and open-source incident response and forensic tools designed to perform detailed digital forensic examinations in a variety of settings.
Snagit	Techsmith	Productivity	The ultimate screen capture & video recording tool for Windows and Mac.
SOF-ELK	Phil Hagen	Various	SOF-ELK is a “big data analytics” platform focused on the typical needs of computer forensic investigators/analysts and information security operations personnel.
The Sleuth Kit	Brian Carrier	Various	The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate disk images. The core functionality of TSK allows you to analyze volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
THOR APT Scanner	Nextron Systems	Various	THOR is the most sophisticated and flexible compromise assessment tool on the market.
THOR Lite Free IOC and YARA Scanner	Nextron Systems	Various	THOR Lite includes the file system and process scan module as well as module that extracts “autoruns” information on the different platforms.
Thumbcache Viewer	Eric Zimmerman	Windows	Thumbcache Viewer allows you to extract thumbnail images from the thumbcache_*.db and iconcache_*.db database files found on Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, and Windows 11.
Thumbs Viewer	Jan Libicek	Windows	Thumbs Viewer allows you to extract thumbnail images from the Thumbs.db, ehthumbs.db, ehthumbs_vista.db, Image.db, Video.db, TVThumb.db, and musicThumbs.db database files found on various Windows operating systems.
Timesketch	Johan Berggren	Documentation	Timesketch is an open-source tool for collaborative forensic timeline analysis.
TRACE	Radoslav Gadzhovski	Windows	TRACE is a digital forensic analysis tool that provides a user-friendly interface for investigating disk images.
TZworks	TZWorks	Various	Suite of forensic tools that either (a) simplify the investigative process, (b) provide new automated capabilities where only manual techniques were available or (c) reverse engineer a new aspect of the operating system to give new artifact analysis capabilities where none existed before.
UAC	Thiago Canozzo Lahr	Various	UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.
unix_collector	Jerzy 'Yuri' Kramarz	Various	unix_collector is a Live Response collection script for Incident Response on UNIX-like systems using native binaries.
USB Detective	Jason Hale	Windows	USB Detective is an application for identifying, investigating, and reporting on USB storage devices that have been connected to a Windows system.
Usnjrnl Rewind	CyberCX	Windows	This script will process the outputs of Eric Zimmerman's MFTEcmd tool and produce a csv that has the complete and correct path for every file and folder (no more Unknowns).
Velociraptor	Velocidex	Various	Velociraptor is an advanced digital forensic and incident response tool that enhances your visibility into your endpoints.
Volatility 2	Volatility Foundation	Memory	Volatility is the world's most widely used framework for extracting digital artifacts from volatile memory (RAM) samples.
Volatility 3	Volatility Foundation	Memory	Volatility is the world's most widely used framework for extracting digital artifacts from volatile memory (RAM) samples.
VLEAPP	Alexis Brignoni	Other	Vehicle Logs Events And Properties Parser.
WELA	Yamamoto Security	Windows	WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs!
WinFE	Troy Larson	Windows	Windows Forensic Environment, also known as WinFE or Windows FE, was originally developed by Troy Larson, Senior Forensic Manager, Microsoft Corporation, by simply adding two registry keys to the Windows Vista Pre-installation Environment 2.0 (WinPE 2.0). These keys prevented the auto-mounting of some of the volumes at boot time, which then allowed the creation of a rudimentary Microsoft Windows based forensic boot CD/DVD or USB Device.
WinPmem	Velocidex	Memory	The multi-platform memory acquisition tool.
X-Ways Forensics	X-Ways	Various	X-Ways Forensics is an advanced work environment for computer forensic examiners and the flagship product.
X-Ways Imager	X-Ways	Various	Forensic disk imaging tool. Stripped down version of the X-Ways Forensics computer forensics software with just the disk imaging functionality and little more.