Digital Forensics Tools and Utilities

Collections
Tools
- Distributions
- Frameworks
- Live Forensics
- IOC Scanner
- Acquisition
- Imageing
- Carving
- Memory Forensics
- Network Forensics
- Windows Artifacts
  - NTFS/MFT Processing
- OS X Forensics
- Mobile Forensics
- Docker Forensics
- Internet Artifacts
- Timeline Analysis
- Disk image handling
- Decryption
- Management
- Picture Analysis
Learn Forensics
- CTFs and Challenges
Resources
- Books
- File System Corpora
- Twitter
- Blogs
- Other

Digital Forensics Tools and Utilities

“Free (mainly open source) forensic investigation tools and resources, hand-picked and organized for your convenience.”

Collections

AboutDFIR – The Definitive Compendium Project – Collection of forensic resources for learning and research. Offers lists of certifications, books, blogs, challenges and more
DFIR.Training – Database of forensic resources focused on events, tools and more
⭐ ForensicArtifacts.com Artifact Repository – Machine-readable knowledge base of forensic artifacts

Tools

Distributions

bitscout – LiveCD/LiveUSB for remote forensic acquisition and analysis
Remnux – Distro for reverse-engineering and analyzing malicious software
SANS Investigative Forensics Toolkit (sift) – Linux distribution for forensic analysis
Tsurugi Linux – Linux distribution for forensic analysis
WinFE – Windows Forensics enviroment

Frameworks

⭐Autopsy – SleuthKit GUI
dff – Forensic framework
dexter – Dexter is a forensics acquisition framework designed to be extensible and secure
hashlookup-forensic-analyser – A tool to analyse files from a forensic acquisition to find known/unknown hashes from hashlookup API or using a local Bloom filter.
IntelMQ – IntelMQ collects and processes security feeds
Kuiper – Digital Investigation Platform
Laika BOSS – Laika is an object scanner and intrusion detection system
PowerForensics – PowerForensics is a framework for live disk forensic analysis
TAPIR – TAPIR (Trustable Artifacts Parser for Incident Response) is a multi-user, client/server, incident response framework
⭐ The Sleuth Kit – Tools for low level forensic analysis
turbinia – Turbinia is an open-source framework for deploying, managing, and running forensic workloads on cloud platforms
IPED – Indexador e Processador de Evidências Digitais – Brazilian Federal Police Tool for Forensic Investigations
Wombat Forensics – Forensic GUI tool

Live Forensics

grr – GRR Rapid Response: remote live forensics for incident response
Linux Expl0rer – Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask
mig – Distributed & real time digital forensics at the speed of the cloud
osquery – SQL powered operating system analytics
POFR – The Penguin OS Flight Recorder collects, stores and organizes for further analysis process execution, file access and network/socket endpoint data from the Linux Operating System.
UAC – UAC (Unix-like Artifacts Collector) is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

IOC Scanner

Fastfinder – Fast customisable cross-platform suspicious file finder. Supports md5/sha1/sha256 hashes, literal/wildcard strings, regular expressions and YARA rules
Fenrir – Simple Bash IOC Scanner
Loki – Simple IOC and Incident Response Scanner
Redline – Free endpoint security tool from FireEye
THOR Lite – Free IOC and YARA Scanner

Acquisition

artifactcollector – A customizable agent to collect forensic artifacts on any Windows, macOS or Linux system
ArtifactExtractor – Extract common Windows artifacts from source images and VSCs
AVML – A portable volatile memory acquisition tool for Linux
Belkasoft RAM Capturer – Volatile Memory Acquisition Tool
CrowdResponse – A static host data collection tool by CrowdStrike
DFIR ORC – Forensics artefact collection tool for systems running Microsoft Windows
FastIR Collector – Collect artifacts on windows
FireEye Memoryze – A free memory forensic software
LiME – Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD
Magnet RAM Capture – A free imaging tool designed to capture the physical memory
unix_collector – A live forensic collection script for UNIX-like systems as a single script.
Velociraptor – Velociraptor is a tool for collecting host based state information using Velocidex Query Language (VQL) queries
WinTriage – Wintriage is a live response tool that extracts Windows artifacts. It must be executed with local or domain administrator privileges and recommended to be done from an external drive.

Carving

bstrings – Improved strings utility
bulk_extractor – Extracts information such as email addresses, creditcard numbers and histrograms from disk images
floss – Static analysis tool to automatically deobfuscate strings from malware binaries
⭐ photorec – File carving tool
swap_digger – A bash script used to automate Linux swap analysis, automating swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, etc.

Imaging

dc3dd – Improved version of dd
dcfldd – Different improved version of dd (this version has some bugs!, another version is on github adulau/dcfldd)
FTK Imager – Free imageing tool for windows
⭐ Guymager – Open source version for disk imageing on linux systems

Memory Forensics

inVtero.net – High speed memory analysis framework developed in .NET supports all Windows x64, includes code integrity and write support
KeeFarce – Extract KeePass passwords from memory
MemProcFS – An easy and convenient way of accessing physical memory as files a virtual file system.
Rekall – Memory Forensic Framework
volatility – The memory forensic framework
VolUtility – Web App for Volatility framework

Network Forensics

Kismet – A passive wireless sniffer
NetworkMiner – Network Forensic Analysis Tool
⭐ WireShark – A network protocol analyzer

Windows Artifacts

Beagle – Transform data sources and logs into graphs
FRED – Cross-platform microsoft registry hive editor
LastActivityView – LastActivityView by Nirsoftis a tool for Windows operating system that collects information from various sources on a running system, and displays a log of actions made by the user and events occurred on this computer.
LogonTracer – Investigate malicious Windows logon by visualizing and analyzing Windows event log
python-evt – Pure Python parser for classic Windows Event Log files (.evt)
RegRipper3.0 – RegRipper is an open source Perl tool for parsing the Registry and presenting it for analysis
RegRippy – A framework for reading and extracting useful forensics data from Windows registry hives

NTFS/MFT Processing

MFT-Parsers – Comparison of MFT-Parsers
MFTEcmd – MFT Parser by Eric Zimmerman
MFTExtractor – MFT-Parser
NTFS journal parser
NTFS USN Journal parser
RecuperaBit – Reconstruct and recover NTFS data
python-ntfs – NTFS analysis

OS X Forensics

APFS Fuse – A read-only FUSE driver for the new Apple File System
mac_apt (macOS Artifact Parsing Tool) – Extracts forensic artifacts from disk images or live machines
MacLocationsScraper – Dump the contents of the location database files on iOS and macOS
macMRUParser – Python script to parse the Most Recently Used (MRU) plist files on macOS into a more human friendly format
OSXAuditor
OSX Collect

Internet Artifacts

ChromeCacheView – A small utility that reads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache
chrome-url-dumper – Dump all local stored infromation collected by Chrome
hindsight – Internet history forensics for Google Chrome/Chromium
IE10Analyzer – This tool can parse normal records and recover deleted records in WebCacheV01.dat.
unfurl – Extract and visualize data from URLs
WinSearchDBAnalyzer – This tool can parse normal records and recover deleted records in Windows.edb.

Docker Forensics

dof (Docker Forensics Toolkit) – Extracts and interprets forensic artifacts from disk images of Docker Host systems
Docker Explorer Extracts and interprets forensic artifacts from disk images of Docker Host systems

Internet Artifacts

ChromeCacheView – A small utility that reads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache
chrome-url-dumper – Dump all local stored infromation collected by Chrome
hindsight – Internet history forensics for Google Chrome/Chromium
IE10Analyzer – This tool can parse normal records and recover deleted records in WebCacheV01.dat.
unfurl – Extract and visualize data from URLs
WinSearchDBAnalyzer – This tool can parse normal records and recover deleted records in Windows.edb.

Management

dfirtrack – Digital Forensics and Incident Response Tracking application, track systems
Incidents – Web application for organizing non-trivial security investigations. Built on the idea that incidents are trees of tickets, where some tickets are leads

Timeline Analysis

DFTimewolf – Framework for orchestrating forensic collection, processing and data export using GRR and Rekall
⭐ plaso – Extract timestamps from various files and aggregate them
Timeline Explorer – Timeline Analysis tool for CSV and Excel files. Built for SANS FOR508 students
timeliner – A rewrite of mactime, a bodyfile reader
timesketch – Collaborative forensic timeline analysis

Disk image handling

Disk Arbitrator – A Mac OS X forensic utility designed to help the user ensure correct forensic procedures are followed during imaging of a disk device
imagemounter – Command line utility and Python package to ease the (un)mounting of forensic disk images
libewf – Libewf is a library and some tools to access the Expert Witness Compression Format (EWF, E01)
PancakeViewer – Disk image viewer based in dfvfs, similar to the FTK Imager viewer
xmount – Convert between different disk image formats

Decryption

hashcat – Fast password cracker with GPU support
John the Ripper – Password cracker

Picture Analysis

Ghiro – A fully automated tool designed to run forensics analysis over a massive amount of images
sherloq – An open-source digital photographic image forensic toolset

Metadata Forensics

ExifTool by Phil Harvey
FOCA – FOCA is a tool used mainly to find metadata and hidden information in the documents

Steganography

Sonicvisualizer
Steghide – is a steganography program that hides data in various kinds of image and audio files
Wavsteg – is a steganography program that hides data in various kinds of image and audio files
Zsteg – A steganographic coder for WAV files

Learn Forensics

Forensic challenges – Mindmap of forensic challenges
OpenLearn – Digital forensic course
Training material – Online training material by European Union Agency for Network and Information Security for different topics (e.g. Digital forensics, Network forensics)

CTFs and Challenges

Champlain College DFIR CTF
CyberDefenders
DefCon CTFs – archive of DEF CON CTF challenges.
Forensics CTFs
MagnetForensics CTF Challenge
MalwareTech Challenges
MalwareTraffic Analysis
MemLabs
NW3C Chanllenges
Precision Widgets of North Dakota Intrusion
ReverseEngineering Challenges

Resources

Web

Blogs

FlashbackData
Netresec
SANS Forensics Blog
SecurityAffairs – blog by Pierluigi Paganini
thisweekin4n6.wordpress.com – Weekly updates for forensics
Zena Forensics

Books

Network Forensics: Tracking Hackers through Cyberspace – Learn to recognize hackers’ tracks and uncover network-based evidence
The Art of Memory Forensics – Detecting Malware and Threats in Windows, Linux, and Mac Memory
The Practice of Network Security Monitoring – Understanding Incident Detection and Response