Free
pcapfex
RegRippy is a modern Python 3 alternative to RegRipper for extracting data from Windows registry hives.
Digital Forensics
Digital forensics for incident response. Uncover digital evidence to understand and resolve security breaches effectively.
Try these 212 AI Digital Forensics Tools
Free
PcapXray
A repository containing material from a talk on sub-domain enumeration techniques
Free
Penguin OS Forensic (or Flight) Recorder (POFR)
Easy-to-use live forensics toolbox for Linux endpoints with various capabilities such as process inspection, memory analysis, and YARA scanning.
Free
PhotoRec
A library to access the Windows New Technology File System (NTFS) format with read-only support for NTFS versions 3.0 and 3.1.
Free
Plaso
dc3dd is a patch to the GNU dd program, tailored for forensic acquisition with features like hashing and file verification.
Free
PowerForensics
A Mac OS X computer forensics tool for analyzing system artifacts, user files, and logs with reputation verification and log aggregation capabilities.
Free
python-ntfs
Dump the contents of the location database files on iOS and macOS with output options like KML and CSV.
Free
Radare2
dc3dd is a patch to the GNU dd program, tailored for forensic acquisition with features like hashing and file verification.
Free
Razzer
A collection of tools for extracting and analyzing information from .git repositories
Free
Recog
Customizable live OS constructor tool for remote forensics and incident response.
Free
Recon
A network forensics tool for visualizing packet captures as network diagrams with detailed analysis.
Free
Free
Rekall
A tool for extracting files from packet capture files with ease of use and extensibility for Python developers.
Free
RegRipper 3.0
Forensic imaging program with full hash authentication and various acquisition options.
Free
Free
Rizin
A library to access the Windows New Technology File System (NTFS) format with read-only support for NTFS versions 3.0 and 3.1.
Free
second-order
A shell script for basic forensic collection of various artefacts from UNIX systems.
Free
ShadowCopy Analyzer
A Forensic Framework for Skype with various investigative options.
Free
Silk Guardian
Easy-to-use live forensics toolbox for Linux endpoints with various capabilities such as process inspection, memory analysis, and YARA scanning.