Digital Forensics Tools Guide: Imaging, Analysis, Mobile

30 min readDeep TechUpdated October 2026

Key points

Digital forensics runs in three phases: acquiring (imaging) the evidence, analysing it, and reporting; each phase has its own tools.
A catalogue of the tools I have used since 2005: all-in-one suites, imaging and write blockers, analysis, Windows, Linux and macOS evidence collection, memory, network and mobile forensics.
Many tools changed hands or stopped since I first wrote the list; the update at the top says which.

Exploring the Critical Field of Digital Forensics

Updated October 2026: Many of the digital forensics tools below changed hands or stopped since I first wrote this list. Guidance Software (EnCase) and Tableau are now part of OpenText, AccessData (FTK) is now Exterro, IEF became Magnet AXIOM, Belkasoft Evidence Center is now Belkasoft X, and TheHive and Cortex are developed by StrangeBee. Volatility 2 was archived in May 2025 in favour of Volatility 3, and Rekall, Mozilla MIG, MozDef, Santoku, DEFT and Cain & Abel are no longer maintained.

Several old tool domains now show gambling or unrelated pages, so I removed those links and noted where a tool’s page is gone. For a maintained open source kit today I would start with Autopsy and The Sleuth Kit, Volatility 3, Plaso and Timesketch, and the SANS SIFT Workstation.

In this article, I cover digital forensics, a field that is not only pertinent to digital investigators and crime cases but also invaluable in private sector internal investigations. Digital forensics, sometimes known as digital forensic science, is a branch of forensic science that involves the recovery and investigation of material found in digital devices, often in connection with computer crime. This field spans several categories, including computer forensics, mobile forensics, network forensics, forensic data analysis, and database forensics.

The digital forensic process consists of three main phases: acquisition (or cloning/imaging) of exhibits, analysis, and reporting. Each phase utilizes its own set of tools or dedicated devices, tailored to the needs of the users and the specific evidence sought.

Why I wrote this digital forensics guide

Having employed various tools since 2005, I am committed to highlighting all vital aspects of this process. My aim is to simplify and expedite the investigation process for professionals, as well as aid individuals in recovering their own lost information.

Below is a showcase of a PC that has been customized and equipped with most of the tools mentioned, which I will discuss in further detail.
showcase.

Updated October 2026: I added the free tools most investigators reach for today, among them Velociraptor, KAPE, Zeek, Hayabusa, Chainsaw, UAC, WinPmem, AVML, MVT and CyberChef, each in the section where it belongs.

Forensic tools guide index

All-in-one Tools

Belkasoft X (formerly Belkasoft Evidence Center) The toolkit will quickly extract digital evidence from multiple sources by analyzing hard drives, drive images, memory dumps, iOS, BlackBerry and Android backups, UFED, JTAG and chip-off dumps.
CimSweep CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.
CIRTKit CIRTKit is not just a collection of tools, but also a framework to aid in the ongoing unification of Incident Response and Forensics investigation processes.
Cyber Triage Cyber Triage remotely collects and analyzes endpoint data to help determine if it is compromised. Its agentless approach and focus on ease of use and automation allow companies to respond without major infrastructure changes and a team of forensics experts. Its results are used to decide if the system should be erased or investigated further.
Digital Forensics Framework DFF is an Open Source computer forensics platform built on top of a dedicated Application Programming Interface (API). DFF proposes an alternative to the ageing digital forensics solutions used today. Designed for simple use and automation, the DFF interface guides the user through the main steps of a digital investigation so it can be used by both professionals and non-experts to quickly and easily conduct digital investigations and perform incident response.
Doorman Doorman is an osquery fleet manager that allows remote management of osquery configurations retrieved by nodes. It takes advantage of osquery’s TLS configuration, logger, and distributed read/write endpoints, to give administrators visibility across a fleet of devices with minimal overhead and intrusiveness.

All-in-one tools from Envdb to LimaCharlie

Envdb turns your production, dev, cloud, etc. environments into a database cluster you can search using osquery as the foundation. It wraps the osquery process with a (cluster) node agent that can communicate back to a central location.
Falcon Orchestrator (its repository is gone) by CrowdStrike is an extendable Windows-based application that provides workflow automation, case management and security response functionality.
FIDO (its repository is gone) Fully Integrated Defense Operation (FIDO) by Netflix is an orchestration layer used to automate the incident response process by evaluating, assessing and responding to malware. FIDO’s primary purpose is to handle the heavy manual effort needed to evaluate threats coming from today’s security stack and the large number of alerts generated by them.
GRR Rapid Response is an incident response framework focused on remote live forensics. It consists of a Python agent (client) that is installed on target systems, and a Python server infrastructure that can manage and talk to the agent.
Kolide (its repository is gone) is an agentless osquery web interface and remote API server. Kolide was designed to be extremely portable (a single binary) and performant while keeping the codebase simple. It replaces Envdb.
LimaCharlie is an endpoint security platform (now a cloud service). It is itself a collection of small projects all working together, and gives you a cross-platform (Windows, OSX, Linux, Android and iOS) low-level environment allowing you to manage and push additional modules into memory to extend its functionality.

All-in-one tools from MIG to The Sleuth Kit

MIG Mozilla InvestiGator (MIG), which Mozilla stopped maintaining in 2019, is a platform to perform investigative surgery on remote endpoints. It enables investigators to obtain information from large numbers of systems in parallel, thus accelerating the investigation of incidents and day-to-day operations security.
MozDef The Mozilla Defense Platform (MozDef, now deprecated) sought to automate the security incident handling process and facilitate the real-time activities of incident handlers.
nightHawk the nightHawk Response Platform is an application built for asynchronous forensic data presentation using Elasticsearch as the backend. It’s designed to ingest Redline collections.
Open Computer Forensics Architecture Open Computer Forensics Architecture (OCFA) is another popular distributed open-source computer forensics framework. This framework was built on a Linux platform and uses PostgreSQL database for storing data.
Osquery with osquery you can easily ask questions about your Linux, macOS and Windows infrastructure. Whether your goal is intrusion detection, infrastructure reliability, or compliance, osquery gives you the ability to empower and inform a broad set of organizations within your company. Queries in the incident-response pack help you detect and respond to breaches.
Redline provides host investigative capabilities to users to find signs of malicious activity through memory and file analysis, and the development of a threat assessment profile.
The Sleuth Kit & Autopsy The Sleuth Kit is a Unix and Windows-based tool which helps in forensic analysis of computers. It comes with various tools which help in digital forensics. These tools help in analyzing disk images, performing in-depth analysis of file systems, and various other things.

All-in-one tools from TheHive to Zentral

TheHive TheHive, now developed by StrangeBee with a free Community license, is a scalable 3-in-1 solution designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly.
Velociraptor from Rapid7 is a free, open-source endpoint tool: it collects artifacts and hunts across thousands of machines at once with its own query language, VQL.
X-Ways Forensics X-Ways is a forensics tool for disk cloning and imaging. It can be used to find deleted files and to analyse disks.
Zentral combines Osquery’s powerful endpoint inventory features with a flexible notification and action framework. This enables one to identify and react to changes on OS X and Linux clients.

Storage media acquisition

Talon, Dossier, and Forensic Falcon cloning devices from Logicube with capture speeds from 7 GB/min to 23 GB/min and a wipe feature; they capture to DD image files and provide MD5 and SHA-256 authentication.
Solo-4 (its page is gone) cloning device from ICS with a capture speed of 12 GB/min with USB 3 and FireWire support.
TD3 (Tableau is now part of OpenText) cloning device from Tableau with a capture speed of 7 GB/min with USB 3 and FireWire support.
WiebeTech Ditto cloning device from CRU with a capture speed of 6.6 GB/min with USB 3 and FireWire support.
FRED cloning device from Digital Intelligence if you are looking for a multi-drive acquisition device that allows you to install your own analysis tools and OS. They offer a portable version as well. An alternative product is Forensic RTX.
WinHex is a software tool that can produce exact duplicates of disks/drives.
FTK Imager (now from Exterro, which bought AccessData) is software that allows you to mount and create images from different types of drives.
Air is a GUI front-end to dd/dc3dd on Linux designed for easily creating forensic images.
ImageUSB is a free utility which lets you clone or write an image concurrently to multiple USB Flash Drives.
OSFClone is a free, self-booting solution which enables you to create or clone exact raw disk images quickly and independently of the installed operating system.
Atola is an acquisition device that can acquire a usable image from damaged media.

More imaging software and write blockers

GetData Forensic Imager, now called FEX Imager, is a Windows-based program that will acquire, convert, or verify a forensic image in one of the common forensic file formats.
Guymager Guymager is a free forensic imager for media acquisition on Linux.
Magnet ACQUIRE ACQUIRE by Magnet Forensics allows various types of disk acquisitions to be performed on Windows, Linux, and OS X as well as mobile operating systems.

Bayit GmbH published comparisons of the Falcon with the TD3, the Solo4 and the WiebeTech Ditto; those PDFs are no longer online.

If you need write blockers, go for WiebeTech (from CRU, now sold by DigiStor) or Tableau (now part of OpenText); they have a good range of them.

Storage media analysis and reporting

EnCase from Guidance Software (now part of OpenText) is my preference for deep forensic analysis; they also have a portable version. You can combine it with IEF (Internet Evidence Finder, now part of Magnet AXIOM) for better Internet investigations.
FTK (Forensic Toolkit) from AccessData (now Exterro) is also a tool that I recommend to have in your forensic Lab.
E3 from Paraben can mount forensic images as a read-only local and physical disc and then explore the contents of the image with File Explorer. You can easily view deleted data and unallocated space in the image. It can mount several images at a time. It supports most of the image formats, including EnCase, SafeBack, PFR, FTK DD, WinImage, raw images from Linux dd, and VMware images. It supports both logical and physical image types.
X-Ways Forensics from X-Ways is a good software product.
Santoku (its site is gone) is a Linux distribution that specializes in Mobile Forensics, Malware, and Security.
Masterkey (its site is gone) is a Linux distribution that specializes in incident response and computer forensics.
Parrot is a Linux distribution designed with cloud pen-testing and IoT security in mind. It includes a full portable laboratory for security and digital forensics experts.
DEFT (its site is gone) is a Live CD built on top of Xubuntu with tools for computer forensics and incident response.
CAINE (Computer Aided Investigative Environment) is an Italian GNU/Linux live distribution based on Ubuntu, created as a digital forensics project, and it contains many forensics tools.

Forensic Linux distributions and appliances

ADIA The Appliance for Digital Investigation and Analysis (ADIA) is a VMware-based appliance used for digital investigation and acquisition and is built entirely from public domain software. Among the tools contained in ADIA are Autopsy, the Sleuth Kit, the Digital Forensics Framework, log2timeline, Xplico, and Wireshark. Most of the system maintenance uses Webmin. It is designed for small-to-medium-sized digital investigations and acquisitions. The appliance runs under Linux, Windows, and Mac OS. Both i386 (32-bit) and x86_64 (64-bit) versions are available.
NST (Network Security Toolkit) is a Linux distribution that includes a vast collection of best-of-breed open source network security applications useful to the network security professional.
PALADIN PALADIN is a modified Linux distribution to perform various forensics tasks in a forensically sound manner. It comes with many open-source forensics tools included.
Security Onion Security Onion is a special Linux distro aimed at network security monitoring featuring advanced analysis tools.
SIFT from SANS is a free, powerful toolkit based on Ubuntu, also offered as a VMware image; the SIFT page gives the login details.
Autopsy is a free, open source and essential digital forensics tool; its interface is simple and easy to use.
The Sleuth Kit is a collection of command line tools and a C library that allows you to analyze disk images and recover files from them. It is used behind the scenes in Autopsy and many other open source and commercial forensics tools.
Forensic Assistant (its site is gone) is a Russian forensic examination software tool with many features; it can find and analyze important forensic information in programs, logs and files.

Open source frameworks and Windows suites

DFF (Digital Forensics Framework) is a free and open-source computer forensics software built on top of a dedicated Application Programming Interface (API).
OCFA (Open Computer Forensics Architecture) is a free and open-source modular computer forensics framework that automates the digital forensic process to speed up the investigation and gives tactical investigators direct access to the seized data through an easy-to-use search and browse interface.
PlainSight (its site is gone) is a CD based Knoppix which is a Linux distribution. Some of its uses include viewing Internet histories, data carving, checking USB device usage, memory dumps extracting password hashes, information gathering, examining Windows firewall configuration, seeing recent documents, and other useful tasks. To use this tool, you only need to boot from the CD and follow the instructions.
ProDiscover from Techpathways is a computer security tool that enables computer professionals to find all the data on a computer disk while protecting evidence and creating evidentiary quality reports for use in legal proceedings.
Microsoft COFEE (Computer Online Forensic Evidence Extractor; its site is gone) is a tool that fits on a USB drive and automates the execution of commands for data extraction and related documentation.
Nuix Investigator is engineered to index, triage, identify, analyze and bring to the surface critical evidence across entire data sets, regardless of the geographical location, repository, file type or size.
Intella® TEAM from Vound enables multiple individuals to review evidence independently and simultaneously, with one case administrator.

Bulk analysis and live response tools

Bulk Extractor from Digital Corpora scans disk images, files or directories of files to extract useful information. In this process, it ignores the file system structure, so it is faster than other available similar kinds of tools. It is basically used by intelligence and law enforcement agencies in solving cyber crimes.
The Coroner’s Toolkit from Dan Farmer and Wietse Venema runs under several Unix-related operating systems. It can be used to aid analysis of computer disasters and data recovery.
Ghiro is a fully automated tool designed to run forensics analysis over a massive amount of images, just using a user-friendly and fancy web application.
Cold Disk Quick Response uses a streamlined list of parsers to quickly analyze a forensic image file (dd, E01, .vmdk, etc.) and output nine reports.
Live Response Collection (its site does not respond) The Live Response collection by BriMor Labs is an automated tool that collects volatile data from Windows, OSX, and *nix based operating systems.

Windows Evidence Collection

AChoir Achoir is a framework and scripting tool to standardize and simplify the process of scripting live acquisition utilities for Windows.
Binaryforay list of free tools for Windows forensics (Eric Zimmerman’s blog).
Crowd Response (CrowdStrike no longer lists it among its community tools) Crowd Response by CrowdStrike is a lightweight Windows console application designed to aid in the gathering of system information for incident response and security engagements. It features numerous modules and output formats.
FastIR Collector FastIR Collector is a tool that collects different artefacts on live Windows systems and records the results in csv files. With the analyses of these artefacts, an early compromise can be detected.
FECT Fast Evidence Collector Toolkit (FECT) is a light incident response toolkit to collect evidence on a suspicious Windows computer. Basically, it is intended to be used by non-tech savvy people working with a journeyman Incident Handler.
Fibratus tool for exploration and tracing of the Windows kernel.
IOC Finder (its download page is gone) IOC Finder is a free tool from Mandiant for collecting host system data and reporting the presence of Indicators of Compromise (IOCs). Support for Windows only.
Fidelis ThreatScanner (its download page is gone) Fidelis ThreatScanner is a free tool from Fidelis Cybersecurity that uses OpenIOC and YARA rules to report on the state of an endpoint. The user provides OpenIOC and YARA rules and executes the tool. ThreatScanner measures the state of the system and, when the run is complete, a report for any matching rules is generated. Windows Only.
LOKI Loki is a free IR scanner for scanning endpoints with YARA rules and other indicators (IOCs).
KAPE from Kroll collects Windows artifacts with ready-made targets and runs parsers such as Eric Zimmerman’s tools over them in minutes.

PowerShell and registry collectors

PowerForensics Live disk forensics platform, using PowerShell.
PSRecon PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
RegRipper RegRipper is an open-source tool, written in Perl, for extracting/parsing information (keys, values, data) from the Registry and presenting it for analysis.
TRIAGE-IR Triage-IR is an IR collector for Windows.

Data recovery

Recover My Files from GetData has an easy-to-use interface and will recover files from crashed disks or formatted ones.
EaseUS Data Recovery from EaseUS will recover files for you; it has a read-only option as well.
R-Studio from R-Tools Technology is a multi-platform tool to recover deleted files.
Restorer Ultimate (its site is gone) from BitMart is the tool to use if you are having difficulties with NTFS partitions.
Phoenix Windows Data Recovery from Stellar is designed to recover photos, videos, and other multimedia files.
PhotoRecovery from LC Technology is designed to recover images, movies and sound files from all types of digital media.
Disk Drill from 508 Software is light and multi-platform file recovery software.
TestDisk and PhotoRec from CGSecurity are free and open source: TestDisk finds lost partitions and repairs boot sectors, and PhotoRec carves files out of disks and memory cards even when the file system is gone.

Password recovery

FRED SC from Digital Intelligence is a dedicated super machine to brute-force passwords; you can combine it with ElcomSoft Distributed Password Recovery. ElcomSoft has a range of password recovery products, including ones for TrueCrypt and PGP Disk.
Passware Kit Forensic from Passware can recover passwords from different types of files and disks.
Hashkill is a free open-source tool that uses GPU power to recover passwords.
hashcat is multi-OS, free and open source, and it can work in a distributed environment to recover passwords.
TrueCrack is a free open-source tool specialized in recovering TrueCrypt containers.
Dropbox-decryptor from Magnet Forensics is a free tool that will decrypt the Dropbox filecache.dbx file which is an encrypted SQLite database.
Cain & Abel from Massimiliano Montoro allowed easy recovery of various kinds of passwords by sniffing the network and cracking encrypted passwords with dictionary attacks (it is discontinued and oxid.it is offline).
AccessData PRTK (AccessData is now Exterro, and this page is gone) gives you the ability to recover passwords from well-known applications.
NirSoft Password Tools has many password viewers including Chrome, Opera and VNC.
John the Ripper from Openwall is a free, open-source password cracker for hundreds of hash and encrypted file types; its *2john helpers pull the hashes out of ZIP, PDF, Office and KeePass files.

Extra utilities

ExifTool is a free, multi-OS tool that can extract many different metadata formats (EXIF and others) from more than 300 file types.
PhotoME is a powerful tool to show and edit the meta/exif data of image files.
XnView is a powerful image viewer that can also read exif data from image files.
RegRipper is an open source tool for extracting/parsing information (keys, values, data) from the Registry and presenting it for analysis.
Windows Registry Recovery lets you read files containing Windows registry hives.
CyberChef from GCHQ decodes, decrypts, decompresses and converts data in the browser (Base64, hex, XOR, timestamps) without sending it anywhere.

Recon (Registry Recon) analyzes registry data, whether it is live, backed up, or even deleted.
ForensicUserInfo is a tool that allows you to import registry files and then extract the user information from the various files and then decrypt the LM/NT hashes from the SAM file.
PrefetchForensics (its page is gone) is an application to extract information from Windows Prefetch files.
USB Historian parses USB information, primarily from the Windows registry, to give you a list of all USB drives that were plugged into the machine.
USBDeviceForensics is an application that extracts numerous bits of information regarding USB devices.
Chrome and Fox Analysis is a software tool for extracting, viewing and analysing Internet history from the Chrome and Firefox web browsers.
NetAnalysis is a leading software for the extraction and analysis of data from Internet browsers.
NirSoft Forensics has multiple browser forensics tools, including one for Opera.
Dumpzilla is a multi-OS forensic tool for Firefox web browsers.
SQLite Expert is a powerful administration tool for your SQLite databases which enables analysis of Skype logs, Firefox logs and other SQLite artefacts.

SQLite, media and hex tools

SQLite Recovery displays all SQLite databases alongside each other, allowing the investigator to gain an overview of the type and content of all of them on the suspect’s computer.
VLC video player that plays just about every possible video format there is.
Notepad++ an extended free version of Notepad that allows conversion and viewing of hex, ASCII, UTF and many other forms of data.
DigitalCorpora provides disk images, memory dumps, and network packet captures to be used for forensics education.
OSFMount allows you to mount local disk image files (bit-for-bit copies of a disk partition) in Windows with a drive letter.
Arsenal Image Mounter from Arsenal Recon mounts forensic images (E01, AFF4, raw) as real disks in Windows, so other tools can read them as if the disk were attached.
HxD hex editor that allows you to perform low-level editing and modifying of a raw disk or main memory (RAM). HxD was designed with ease of use and performance in mind and can handle large files without issue. Features include searching and replacing, exporting, checksums/digests, an in-built file shredder, concatenation or splitting of files, generation of statistics and more.
DSi USB Write Blocker (its site is gone) DSi USB Write Blocker is a software-based write blocker that prevents write access to USB devices.
LastActivityView allows you to view what actions were taken by a user and what events occurred on the machine. Any activities such as running an executable file, opening a file/folder from Explorer, an application or system crash or a user performing a software installation will be logged. The information can be exported to a CSV / XML / HTML file.

Threat intelligence and IOC scanners

Cortex Cortex allows you to analyze observables such as IP and email addresses, URLs, domain names, files or hashes one by one or in bulk mode using a Web interface. Analysts can also automate these operations using its REST API.
CRITs is a web-based tool which combines an analytic engine with a cyber threat database.
Fenrir Fenrir is a simple IOC scanner. It allows scanning any Linux/Unix/OSX system for IOCs in plain bash. Created by the creators of THOR and LOKI.
Fileintel Pull intelligence per file hash.
Hindsight Internet history forensics for Google Chrome/Chromium.
Hostintel Pull intelligence per host.
Kansa Kansa is a modular incident response framework in Powershell.
rastrea2r allows one to scan disks and memory for IOCs using YARA on Windows, Linux and OS X.
RaQet (its old project site now redirects to an unrelated site) RaQet is an unconventional remote acquisition and triaging tool that allows the triage of a disk of a remote computer (client) that is restarted with a purposely built forensic operating system.
pt-stalk collects forensic data about MySQL when problems occur.
Elcomsoft Cloud eXplorer a command line utility to acquire forensic data from cloud services.
Stenographer Stenographer is a packet capture solution which aims to quickly spool all packets to disk, and then provide simple, fast access to subsets of those packets. It stores as much history as possible, manages disk usage, and deletes when disk limits are hit. It’s ideal for capturing the traffic just before and during an incident, without the explicit need to store all of the network traffic.

Network tracing and data wiping

traceroute-circl traceroute-circl is an extended traceroute to support the activities of CSIRT (or CERT) operators. CSIRT teams usually have to handle incidents based on IP addresses received. Created by CIRCL, the Computer Incident Response Center Luxembourg.
X-Ray 2.0 A Windows utility (poorly maintained or no longer maintained) to submit virus samples to AV vendors.
To wipe data (secure delete selective files) go for BCWipe (Commercial). A free alternative of it is Eraser.
To wipe data (secure delete an entire hard disk) go for DBAN (free, for hard disk drives only: it does not securely erase SSDs). A commercial alternative of it is Blancco Drive Eraser.

Incident Management

FIR Fast Incident Response (FIR) is a cybersecurity incident management platform designed with agility and speed in mind. It allows for easy creation, tracking, and reporting of cybersecurity incidents and is useful for CSIRTs, CERTs and SOCs alike.
RTIR Request Tracker for Incident Response (RTIR) is the premier open-source incident handling system targeted for computer security teams. Best Practical built it with over a dozen CERT and CSIRT teams around the world to help you handle the ever-increasing volume of incident reports. RTIR builds on all the features of Request Tracker.
SCOT Sandia Cyber Omni Tracker (SCOT) is an Incident Response collaboration and knowledge capture tool focused on flexibility and ease of use. Its goal is to add value to the incident response process without burdening the user.
threat_note A lightweight investigation notebook that allows security researchers the ability to register and retrieve indicators related to their research.

Linux Evidence Collection

FastIR Collector Linux FastIR for Linux collects different artefacts on live Linux and records the results in csv files.
UAC (Unix-like Artifacts Collector) is a free shell script that collects live response artifacts from Linux, macOS, the BSDs and other Unix systems.

Log Analysis Tools

Lorg a tool for advanced HTTPD logfile security analysis and forensics.
Hayabusa from Yamato Security builds a fast timeline of Windows event logs and flags threats with Sigma rules.
Chainsaw from WithSecure searches and hunts through Windows event logs and MFT records with Sigma rules.

macOS Evidence Collection

KnockKnock displays persistent items (scripts, commands, binaries, etc.) that are set to execute automatically on macOS.
OSX Auditor OSX Auditor is a free Mac OS X computer forensics tool.
OSX Collector An OSX Auditor offshoot for live response.

Process Dump Tools

Microsoft User Mode Process Dumper (Microsoft removed the download) The User Mode Process Dumper (userdump) dumps any running Win32 processes memory image on the fly.
PMDump (its site is gone) PMDump is a tool that lets you dump the memory contents of a process to a file without stopping the process.

Timeline Tools

Highlighter (its download page is gone) Free tool from FireEye/Mandiant that will depict log/text file that can highlight areas on the graphic, that correspond to a keyword or phrase. Good for time lining an infection and what was done post-compromise.
Plaso a Python-based backend engine for the tool log2timeline.
Timesketch open source tool for collaborative forensic timeline analysis.

Videos

Demisto IR video resources (Demisto is now Cortex XSOAR from Palo Alto Networks, and the video page is gone) Video Resources for Incident Response and Forensics Tools.
The Future of Incident Response Presented by Bruce Schneier at OWASP AppSecUSA 2015.

Fingerprint pattern pressed into snow — Digital Forensics.

Network forensic

Decision Group (its site is gone) has a variety of network forensic tools including E-Detective, Wireless-Detective, HTTPS/SSL, VoIP-Detective, and Introduction of Forensics Investigation Toolkit.
NetSleuth (its domain is parked) from Netgrab is a free network monitoring and forensics analysis tool.
NetDetector from NIKSUN offers advanced forensics, providing the deepest extraction of content from network packets.
NetworkMiner from NETRESEC multi OS collects data (such as forensic evidence) about hosts on the network rather than collecting data regarding the traffic on the network.
Helix3 Enterprise (the e-fense domain now shows an unrelated gambling site) from e-Fense was developed by computer forensic experts and it’s an easy-to-use cyber security solution integrated into your network giving you visibility across your entire infrastructure revealing malicious activities.
CNE Investigator (its site is gone) from SpectorSoft automatically records all computer activity, creating a record that can be used as evidence in civil and criminal litigation.
xplico from Gianluca Costa is an open-source network forensic analysis tool. It is basically used to extract useful data from applications which use Internet and network protocols. It supports most of the popular protocols including HTTP, IMAP, POP, SMTP, SIP, TCP, UDP and others. Output data of the tool is stored in an SQLite or MySQL database. It supports both IPv4 and IPv6.
Zeek is a free, open-source network monitor that turns traffic into detailed logs of connections, DNS, HTTP, TLS and files for investigation.
Arkime (formerly Moloch) records and indexes full packet capture, so you can search the sessions and export only the packets you need.

Memory (RAM) forensic

Memoryze (its download page is gone) from Mandiant is free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the paging file in its analysis.
Digital DNA (its maker HBGary was bought by ManTech in 2012) from HBGary identifies and analyzes the most advanced malware threats in physical memory, including those used against global organizations for theft of intellectual property, business intelligence, customer records, and classified information.
Second Look (its old domain now shows an unrelated site) from Raytheon Pikewerks is memory forensics software providing powerful, easy-to-use memory acquisition and analysis capabilities for Linux systems.
WindowsSCOPE provides memory acquisition and access to locked computers (access live memory and encrypted disks without needing password).
volafox is a memory analysis toolkit developed in Python 2.x.
Volatility 3 provides extraction of digital artefacts from volatile memory (RAM) samples. Volatility 2 was archived in May 2025.
Redline tool for memory and file analysis. It collects information about running processes on a host, drivers from memory and gathers other data like meta data, registry data, tasks, services, network information and Internet history to build a proper report.
Evolve Web Interface for the Volatility Memory Forensics Framework.
inVtero.net Advanced memory analysis for Windows x64 with nested hypervisor support.
KnTList (its site does not respond) Computer memory analysis tools.
LiME is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices.

More memory acquisition tools

Rekall Open source tool (and library) for the extraction of digital artifacts from volatile memory (RAM) samples (discontinued in 2020; its old domain now shows a parking page).
Responder PRO (its site is gone) Responder PRO is the industry standard physical memory and automated malware analysis solution.
VolatilityBot VolatilityBot is an automation tool for researchers that cuts all the guesswork and manual tasks out of the binary extraction phase, or to help the investigator in the first steps of performing a memory analysis investigation.
Belkasoft Live RAM Capturer A tiny free forensic tool to reliably extract the entire content of the computer’s volatile memory, even if protected by an active anti-debugging or anti-dumping system.
Linux Memory Grabber A script for dumping Linux memory and creating Volatility profiles.
Magnet RAM Capture Magnet RAM Capture is a free imaging tool designed to capture the physical memory of a suspect’s computer. Supports recent versions of Windows.
OSForensics OSForensics can acquire live memory on 32bit and 64bit systems. A dump of an individual process’s memory space or physical memory dump can be done.
WinPmem is a free, open-source memory acquisition tool for Windows from the Velociraptor developers.
AVML from Microsoft acquires memory on Linux without building a kernel module first, and writes images that Volatility 3 can read.

Mobile forensic

UFED Touch Ultimate device from Cellebrite can perform extraction, decoding, analysis and reporting of mobile data. It performs physical, logical, file system and password extraction of all data (even if deleted) from the widest range of devices including legacy and feature phones, smartphones, portable GPS devices, tablets and phones manufactured with Chinese chipsets.
XRY device from Micro Systemation is complete with all the necessary hardware for recovering data from mobile devices in a forensically secure manner. They also have a field version of the product.
CellXtract and CellXtract-TNT from Logicube provide fast and thorough forensic data extraction from mobile devices.
Elcomsoft iOS Forensic device from Elcomsoft performs the complete forensic acquisition of user data stored in iPhone/iPad/iPod devices including passwords, encryption keys, and decrypting the file system image on supported iOS versions. They also provide a strong phone password breaker EPPB.
secureview3 (its site does not respond) device from Susteen is a mobile forensic kit that provides 3 specific processes for examination: acquire, analyze, and report.
Paraben from software to hardware Paraben covers the complete range of needs of any investigator, whether at the forensic or detective level.
FoneLab software tool from Aiseesoft retrieves and exports 8 types of data including WhatsApp, iMessages, Notes, contacts and more from iOS devices.
MOBILedit Forensic software tool from Compelson extracts all content and generates a forensic report ready for courtroom presentation.
Oxygen Forensic software and hardware tool from Oxygen Forensics offers logical analysis of cell phones, smartphones and tablets, using advanced proprietary protocols.

Mobile forensics software

MPE+ (AccessData is now Exterro, and this page is gone) software tool from AccessData is a stand-alone mobile forensics software solution that is also available on a preconfigured touch-screen tablet for on-scene mobile forensics triage.
SAFT (its page is gone) software tool is a free and easy-to-use mobile forensics application developed by SignalSEC security researchers.
Lantern (its old domain now shows an unrelated site) software tool is mobile forensics that supports iOS, OS X, and Android.
BlackBerry Backup Extractor (its site is gone) software tool that can recover any file from a BBDM backup, along with saved games, debug information and data that might otherwise be inaccessible.
Digital Forensic Analysis System (DFAS) from UROCK, the Korean company formerly called DFORENSIC, is a forensic analysis suite; its first versions supported iOS, OS X and Android.
Magnet AXIOM & GrayKey Integration Examine digital evidence from mobile, cloud, computer, and vehicle sources, alongside third-party extractions all in one case file.
SalvationDATA SPF Pro With SalvationDATA SPF Pro, you’re capable of deeply accessing various cell phones under Android & iOS (iPhone), Symbian and BlackBerry, supporting 99% of those under Chinese brands, like Huawei, Oppo, Xiaomi etc.
MVT (Mobile Verification Toolkit) from Amnesty International’s Security Lab checks Android and iOS backups for traces of spyware such as Pegasus.
ALEAPP and iLEAPP by Alexis Brignoni are free tools that parse Android and iOS extractions into readable reports.

Mobile extra utilities

MyPhoneExplorer is a software tool from Fjsoft that can extract information from Android and Sony Ericsson phones.
MobileGo (now part of Dr.Fone) is a software tool from Wondershare that can extract information from Android and iPhone.
HiSuite is a software tool from Huawei that can manage and extract information from Android phones.
iFunbox is a software tool that can manage files on iPhone/iPad just like Windows Explorer and can be used to extract some information from the device.
iPhone Backup Extractor is a software tool that can extract files (contacts, pictures, call histories, MMS, SMS, video, voicemail, calendar entries, notes, app files and saved games) from the backups iTunes automatically makes of your iPhone, iPad or iPod Touch. Another good alternative is iBackupBot.
WhatsApp Pocket is a software tool from Fireebok that allows you to extract WhatsApp messages from your iPhone to your computer.
Syncios is a software tool from Anvsoft Inc that allows you to extract WhatsApp messages from your iPhone to your computer.
Enigma Recovery (Enigma Recovery’s own site now shows a gambling page) is a software tool that allows you to extract WhatsApp messages and many other things from your iPhone to your computer.
EaseUS iOS is a software tool that allows you to extract WhatsApp messages and many other things from your iPhone to your computer.
Phone Rescue is a software tool that allows you to extract WhatsApp messages and many other things from your iPhone to your computer.
Dr.Fone is a software tool that allows you to extract WhatsApp messages and many other things from your iPhone to your computer.

WhatsApp and Android tools

WhatsApp Xtract is a tool from xda-dev that allows you to extract WhatsApp messages from your iPhone to your computer.
Android Injector is a tool from Harmony Hollow that allows you to install apps (Trojans) on your Android powered phone or device without having to get them through the Google Play Store.

Dig the web

Copernic Agent (its page is gone) is a software tool from Copernic that can send your queries to several search engines and aggregate the results for you.
Dogpile web search engine that can search multiple search engines at once.
social-searcher web search engine that specialises in social network searches.
Keyhole web search engine that can search social networks and provides social analytics in real-time.
Social Mention (the service is gone) web search engine that specialises in social network searches with sentiment features.
Sysomos Heartbeat (now part of Meltwater) is a commercial web application to monitor keywords on social networks.
Synthesio is another commercial web application to monitor keywords on social networks.
DataSift, which previously ran TweetMeme, is another commercial web application to monitor keywords on social networks (it is now part of Meltwater).
Gnip (bought by Twitter in 2014) is another commercial web application to monitor keywords on social networks.
Buzzsumo is another commercial web application to monitor keywords and links engagements on social networks.
Shy Girl, a tool of mine, can extract information from a domain name.

Please read the ACPO guideline; it has most of the instructions you need as a forensic expert.
For social engineering, I recommend Maltego and SET. If you have a great tool that is not listed above feel free to leave a message on this blog or contact me directly.

The little secret on Digital Forensics