A list of free and open forensics analysis tools and other resources
This page lists names, links and short descriptions. The original list on GitHub is the source and belongs to its authors.
Collection of forensic resources for learning and research. Offers lists of certifications, books, blogs, challenges and more
Collection of SQL queries templates for digital forensics use by platform and application.
Database of forensic resources focused on events, tools and more
An updated list of forensic tools created by Eric Zimmerman, an instructor for SANS institute.
LiveCD/LiveUSB for remote forensic acquisition and analysis
CAINE is a Ubuntu-based app that offers a complete forensic environment that provides a graphical interface. This tool can be integrated into existing software tools as a module. It automatically extracts a timeline from RAM.
Santoku is dedicated to mobile forensics, analysis, and security, and packaged in an easy to use, Open Source platform.
Linux distribution that simplifies various forensics tasks in a forensically sound manner via the PALADIN Toolbox
Linux distribution for forensic analysis
Windows Forensics enviroment
Linux distribution for forensic analysis
Forensic framework
Dexter is a forensics acquisition framework designed to be extensible and secure
IntelMQ collects and processes security feeds
Digital Investigation Platform
Laika is an object scanner and intrusion detection system
is a framework for reading and extracting useful forensics data from Windows registry hives.
PowerForensics is a framework for live disk forensic analysis
Turbinia is an open-source framework for deploying, managing, and running forensic workloads on cloud platforms
Brazilian Federal Police Tool for Forensic Investigations
Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask
Distributed & real time digital forensics at the speed of the cloud
A customizable agent to collect forensic artifacts on any Windows, macOS or Linux system
Extract common Windows artifacts from source images and VSCs
A portable volatile memory acquisition tool for Linux
Forensics artefact collection tool for systems running Microsoft Windows
Collect artifacts on windows
Free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the paging file in its analysis.
Graphical interface for the forensic logical acquisition of Mac computers
Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD
is a free imaging tool designed to capture the physical memory
Extract files from Apple devices on Windows, Linux and MacOS. Mostly a wrapper for pymobiledevice3. Creates iTunes-style backups and "advanced logical backups"
Velociraptor is a tool for collecting host based state information using Velocidex Query Language (VQL) queries
Improved version of dd
Different improved version of dd (this version has some bugs!, another version is on github adulau/dcfldd)
Free imageing tool for windows
Improved strings utility
Extracts informations like email adresses, creditscard numbers and histrograms of disk images
Static analysis tool to automatically deobfuscate strings from malware binaries
A bash script used to automate Linux swap analysis, automating swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, etc.
provides host investigative capabilities to users to find signs of malicious activity through memory and file analysis and the development of a threat assessment profile.
High speed memory analysis framework developed in .NET supports all Windows x64, includes code integrity and write support
Extract KeePass passwords from memory
An easy and convenient way of accessing physical memory as files a virtual file system.
PowerShell script utilized to simplify the usage of MemProcFS and to optimize your memory analysis workflow.
Memory Forensic Framework
Web App for Volatility framework
Transform data sources and logs into graphs
by CrowdStrike is a static host data collection tool
Cross-platform microsoft registry hive editor
LastActivityView by Nirsoftis a tool for Windows operating system that collects information from various sources on a running system, and displays a log of actions made by the user and events occurred on this computer.
Investigate malicious Windows logon by visualizing and analyzing Windows event log
Pure Python parser for classic Windows Event Log files (.evt)
RegRipper is an open source Perl tool for parsing the Registry and presenting it for analysis.
Comparison of MFT-Parsers
MFT-Parser
Complete NTFS forensics tool
Reconstruct and recover NTFS data
NTFS analysis
Tool that analyzes Linux filesystem (ext4, XFS) journals (not systemd-journald logs), generates timelines, and detects suspicious activities
is a read-only FUSE driver for the new Apple File System
is a Mac OS X forensic utility designed to help the user ensure correct forensic procedures are followed during imaging of a disk device
locations artifacts by mac4n6 group
Extracts forensic artifacts from disk images or live machines
Dump the contents of the location database files on iOS and macOS.
Python script to parse the Most Recently Used (MRU) plist files on macOS into a more human friendly format.
A collection of PowerShell scripts for analyzing macOS Forensic Artifacts
Shell script utilized to collect macOS Forensic Artifacts from a compromised macOS endpoint
Free Mac OS X computer forensics tool.
Forensic evidence collection & analysis toolkit for macOS.
is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices
An Android Logs Events and Protobuf Parser
Dump the contents of the StateModel#.archive files located in /private/var/mobile/Library/Caches/com.apple.routined/
Perform different kinds of acquisitions on iOS devices
is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
is an app for extracting data from iPhone and iPad backups.
Extracts and interprets forensic artifacts from disk images of Docker Host systems
Extracts and interprets forensic artifacts from disk images of Docker Host systems
by Nirsoft is a small utility that reads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache
Dump all local stored infromation collected by Chrome
extract all forensic interesting information of Firefox, Iceweasel and Seamonkey browsers
Internet history forensics for Google Chrome/Chromium
Extract and visualize data from URLs
Offline profile decryption tool for Mozilla Firefox. Supports multi-core CPU-based cracking of the master password and the latest Firefox hash formats, including those not yet supported by Hashcat and JTR.
Decrypt Chrome profile data offline using the Chrome Safe Storage keyring secret.
Framework for orchestrating forensic collection, processing and data export using GRR and Rekall
A rewrite of mactime, a bodyfile reader
Collaborative forensic timeline analysis
is a Mac OS X forensic utility designed to help the user ensure correct forensic procedures are followed during imaging of a disk device
Command line utility and Python package to ease the (un)mounting of forensic disk images
Libewf is a library and some tools to access the Expert Witness Compression Format (EWF, E01)
allows you to mount local disk image files (bit-for-bit copies of an entire disk or disk partition) in Windows as a physical disk or a logical drive
Disk image viewer based in dfvfs, similar to the FTK Imager viewer.
Convert between different disk image formats
Fast password cracker with GPU support
Password cracker
Binwalk is a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images.
is a program to recover files based on their headers and footers
An application for viewing and analysing the contents of music audio files.
is a steganography program that hides data in various kinds of image and audio files
analyze images in different planes by taking off bits of the image
is a steganography program that hides data in various kinds of image and audio files
A steganographic coder for WAV files
Python 3 application for forensic acquisition of online content, including web pages, emails, and social media.
Scan websites for malicious behaviours and fingerprint JavaScripts.
Mindmap of forensic challenges
Digital forensic course
Online training material by European Union Agency for Network and Information Security for different topics (e.g. Digital forensics, Network forensics)
Blue team challenges including OSINT.
archive of DEF CON CTF challenges.
A curated list of CTF frameworks, libraries, resources and softwares
blog by Pierluigi Paganini
Learn to recognize hackers’ tracks and uncover network-based evidence
Detecting Malware and Threats in Windows, Linux, and Mac Memory
Understanding Incident Detection and Response
Cell Phone Investigations is the most comprehensive book written on cell phones, cell sites, and cell related data.
Apple OS X & iOS Digital Forensics
Brian Carrier, author of Autopsy and the Sleuth Kit
Detective & Digital Forensic Examiner
Certified SANS Instructor
Computer forensic geek
SANS Certified Instructor
DFIR+Malware
Mac Nerd, Forensic Analyst, Author & Instructor of SANS FOR518
PowerShell Forensics
Computer Forensics Examiner
Subreddit for computer forensics
Posters of file system structures
Presentation Archives for OS X and iOS Related Research
Different CheatSheets from SANS
Digital Forensics Posters from SANS
White Papers written by forensic practitioners seeking GCFA, GCFE, and GREM Gold
jaywcjlove/awesome-mac
This project is dedicated to collecting high-quality macOS software and organizing them systematically by different categories for easy search and use.
serhii-londar/open-source-mac-os-apps
🚀 Awesome list of open source applications for macOS. https://t.me/s/opensourcemacosapps
ramitsurana/awesome-kubernetes
A curated list for awesome kubernetes sources :ship::tada:
sindresorhus/awesome-nodejs
:zap: Delightful Node.js packages and resources [BECAUSE OF TOO MUCH SPAM AND LOW-QUALITY SUBMISSIONS, SUBMISSIONS ARE PAUSED TEMPORARILY]
frenck/awesome-home-assistant
A curated list of amazingly awesome Home Assistant resources.
vsouza/awesome-ios
A curated list of awesome iOS ecosystem, including Objective-C and Swift Projects