Forensic Software Guides

A free imaging tool from Exterro that makes forensic images in E01 and raw (dd) formats and verifies them with MD5 and SHA-1 hashes. Examiners use it to image a drive through a write blocker, preview files before imaging or capture RAM from a live Windows machine.

An open-source graphical platform built on The Sleuth Kit for examining disk images. Examiners use it to recover deleted files, run keyword searches, read web history and build timelines.

A long-standing commercial suite, now from OpenText, for imaging, searching and examining evidence from computers and other media. Examiners use it on large cases that need keyword search, hash filtering, carving of deleted files and detailed reports.

A mobile extraction system for Android and iOS devices that can make logical, file system and on some models physical extractions, depending on the phone and its software version. Examiners usually pair it with Cellebrite Physical Analyzer to decode chats, call logs, media and app data.

A mobile forensics tool from MSAB (formerly Micro Systemation) that extracts data from smartphones, feature phones and SIM cards, including call logs, messages and contacts. Examiners use it in criminal and corporate cases and share its reports with lawyers and courts.

A free, open-source packet analyser that captures traffic and decodes a very wide range of protocols, from TCP/IP and DNS to HTTP. Examiners use it to open PCAP files, filter out suspicious traffic and follow a conversation between two hosts during a breach investigation.

A network forensics tool that combines full packet capture with session metadata, so analysts can search and rebuild traffic quickly. It suits enterprise investigations into intrusions and data exfiltration, including long-running attacks by advanced threat groups.

An open-source framework for analysing RAM captures from Windows, Linux and macOS. Examiners use it to list processes, network connections and injected code, which helps find malware that leaves little trace on disk.

A disassembler and debugger from Hex-Rays that turns machine code into readable assembly and supports many processor types and file formats. Malware analysts use it to study how a sample works, for example how a ransomware strain encrypts files or contacts its server.

An open-source sandbox that runs a suspicious file in an isolated virtual machine and records its file, registry and network activity. Examiners use it, or CAPE, its actively maintained fork, for quick checks on email attachments and downloads during incident response.

An AWS service that records API calls and account activity, such as who signed in, which resources were created and from which IP address. Investigators review CloudTrail logs to trace a cloud incident, for example a leaked access key used to start servers or download data.

A data recovery program from R-Tools Technology that rebuilds damaged file systems, finds deleted partitions and carves files from raw data on NTFS, FAT, exFAT, HFS+, APFS and ext volumes. Examiners run it on a forensic image when files are lost through deletion, formatting or file system damage.