Forensic tools directory

UFED is the name most examiners know for Cellebrite's phone extraction tool. Today it continues as the access and extraction part of the Inseyets suite.

Inseyets is Cellebrite's current flagship for mobile evidence. It puts the extraction side (Inseyets.UFED) and the decoding side (Inseyets.PA) under one name and one licence.

Physical Analyzer is the decoding and analysis side of Cellebrite's mobile workflow. PA 7 is being discontinued and the database-backed PA Ultra has become Inseyets.PA 10.x.

Premium is Cellebrite's advanced access capability for locked and encrypted handsets. Cellebrite has said the Premium name is going away as its capabilities are folded into Inseyets.

UFED Cloud is Cellebrite's component for collecting data from cloud services tied to a device, using tokens found on the phone or credentials provided under legal authority. Cellebrite now ships this inside Inseyets.PA.

Cellebrite Reader is a free, portable viewer for UFDR files, the report format produced by Physical Analyzer and Inseyets. It lets people outside the lab review the evidence without a licence.

Pathfinder is Cellebrite's analytics layer. It takes the output of many extractions and other data sources and lets a case team search, link and visualise them together, on a server the agency controls or in a cloud environment.

XRY is MSAB's mobile data extraction software, sold as a family of modules and delivered on office, field, kiosk and tablet platforms. Its output is analysed in XAMN and managed through XEC.

XRY Pro is the advanced tier of the XRY family, aimed at locked and encrypted devices that standard modules cannot reach. MSAB restricts it to practitioners who hold a current XRY certification.

The PC-3000 Portable PRO is ACE Lab's field unit for working with damaged hard drives and solid state drives. It is the portable branch of the PC-3000 family and the current generation after the Portable III.

The PC-3000 Express is the laboratory version of the PC-3000 family, a tester board fitted inside a workstation for hard drive diagnostics, firmware repair and data recovery.

The PC-3000 Flash reads raw NAND memory chips and rebuilds the user data that a dead or damaged controller can no longer present.

PC-3000 SSD is the solid state drive module of the PC-3000 family. It runs on ACE Lab's hardware and gives the examiner access to the drive's technological mode, where the controller can be made to reveal user data it will no longer serve through the normal interface.

Data Extractor is the software that turns a PC-3000 board or portable unit into an imager for drives that are unstable, slow or partly unreadable.

MRT Ultra is MRT Lab's multi-port recovery card. The current generation, released in 2026, is the MRT Ultra 3.0 Six-Port Card, used with the MRT data recovery software for firmware repair and imaging of hard drives.

A hardware write blocker sits between an evidence drive and the examiner's computer and refuses every write command. It is the first device a new examiner should understand.

A forensic duplicator is a standalone imaging device. It copies a source drive to a destination drive or image file, hashes the result and verifies it, without a computer in between.

Wireshark captures network traffic and shows every packet decoded field by field. It is the standard first tool for reading a packet capture in an investigation.

XAMN is where an XRY extraction becomes readable evidence. MSAB sells XAMN Pro for analysis and gives away XAMN Viewer so that others in the case team can open the same files.

XEC is MSAB's Manage line. XEC Director connects every XRY installation in an organisation into one network for oversight and updates, while XEC Export batch-exports XRY files.

Oxygen Forensic Detective is an all-in-one extraction and analysis tool for phones, cloud accounts, drones and other connected devices. On 2 November 2026 the maker's website could not be checked, so this profile is marked unverified.

Compelson now sells its phone forensics tool as MOBILedit Forensic. The Forensic Express name survives only in old web addresses. The product comes in editions, from a single-phone licence to the ULTRA edition that the maker classes as a dual-use item.

Graykey is Magnet Forensics' device access product for locked iOS and Android handsets. Magnet sells it only to public safety agencies in selected countries and vets every enquiry through an agency email address.

Magnet ACQUIRE was Magnet Forensics' free acquisition tool for Android and iOS devices, later extended to computers. It no longer appears on Magnet's product or free tools pages. Its acquisition engine now lives inside Magnet Axiom.

Axiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.

Axiom Cyber is the Axiom variant for organisations rather than police. It adds remote collection from Windows, Mac and Linux endpoints, including machines that are off the corporate network. It can be hosted in AWS or Azure.

EnCase Forensic, one of the oldest names in computer forensics, is now called OpenText Forensic (EnCase). OpenText says it is the same product, renamed to fit its cybersecurity portfolio.

FTK is the Forensic Toolkit that AccessData built and Exterro has owned since late 2020. Today Exterro sells it as Exterro FTK in a standalone form and as FTK Central for teams, with FTK Imager alongside.

FTK Imager is the free tool most learners meet first. It makes forensic images of drives, folders and memory, verifies them with hashes and lets an examiner preview evidence before committing to a full acquisition.

X-Ways Forensics is the German examination tool that runs light, starts fast and gives the examiner the raw disk alongside the parsed view. Version 21.9 was current when this page was checked.

Belkasoft X is a single tool for computer, mobile, drone, vehicle and cloud evidence. Belkasoft sells X Forensic to government customers and X Corporate to businesses, both on a perpetual licence.

Autopsy is a free, open source examination platform that puts a graphical interface and ingest modules on top of The Sleuth Kit. For a student it is the first tool that shows a whole case from image to report at no cost.

The Sleuth Kit, usually written TSK, is a C library and a set of command line tools for examining disk images and file systems. Autopsy is its graphical face. Working with TSK directly teaches what the graphical tools hide.

OSForensics is PassMark's Windows examination suite. It indexes and searches a drive or image, recovers deleted files, uncovers user activity and keeps everything in a case file, with a free edition for learning and paid editions for full use.

Arsenal Image Mounter, or AIM, mounts a disk image in Windows as a complete disk rather than a share, so Windows itself sees partitions, shadow copies and BitLocker volumes. The free mode covers mounting; Professional Mode adds virtual machine launch and more.

Digital Evidence Investigator, or DEI, is ADF's triage tool for computers and storage media. It scans a machine from a USB Collection Key, live or from boot, against prepared search profiles. ADF's site now leads with ADF PRO, which adds mobile devices. The DEI page is marked for customer renewals.

NetworkMiner reads a packet capture and sorts what it finds by host, file, session and credential. It is the tool to open when the question is what happened on the wire rather than which flag was set in which packet.

Zeek watches a network link and writes what it sees as structured logs rather than packets. For a forensic analyst that means hours of traffic become tables that can be searched, joined and placed on a timeline.

tcpdump captures packets from the command line and libpcap is the library it and many other programs use to do it. Between them they define the pcap format that network forensics is built on.

Arkime stores packets at scale and indexes the sessions they belong to, so an analyst can search weeks of traffic by field and pull back the exact packets in seconds.

Velociraptor puts a small agent on endpoints and lets an examiner ask them questions in a query language. A hunt sends the same question to every machine and the answers come back as tables.

Plaso pulls every timestamp it can recognise out of a disk image or folder and writes them to one storage file. Sorted, that file is the super timeline investigators use to see what happened in what order.

Timesketch is a web application where several analysts work on the same timeline. Events from Plaso or CSV go into a sketch and the team searches, tags, comments and builds its account of events from them.

KAPE copies the files an examiner needs from a Windows system or image in minutes and then runs other programs over them. It is the quickest route from a live machine to parsed artefacts.

A set of free, signed Windows forensic utilities, one per artefact, that turn registry hives, the master file table, event logs, prefetch, shellbags and jump lists into CSV an examiner can read in Timeline Explorer.

Volatility 3 reads a memory image and rebuilds what the operating system knew at the moment of capture: processes, connections, loaded modules, handles and code that never touched the disk. It replaced Volatility 2, which is now archived.

Amped FIVE is a workstation for CCTV and image evidence. It opens proprietary DVR files, applies documented filters to make what is there easier to see and writes a report of every step. Clarifying a picture is a different job from proving it is genuine.

Amped Authenticate asks a different question from FIVE. Not what does this picture show, but can this file be trusted. It tests integrity, reconstructs processing history, links an image to a camera and searches for manipulated or generated content.

FFmpeg is the engine behind most media software. For an examiner its three commands inspect a file's streams, extract frames without guessing and convert footage for viewing with every setting on record.

ExifTool reads the metadata inside a file and prints it in full: camera, lens, timestamps, GPS, editing software, maker notes and embedded thumbnails. It is the first stop when a photo or video has to explain where it came from.

MediaInfo reads a media file's structure and reports it: container, video and audio codecs, bit rates, frame rate, duration, encoding settings and tags. It tells an examiner what a file is before any player opens it.

ImageMagick converts, inspects and processes images from the command line or from code. In a forensic laboratory it is the scripting layer for image work: batch conversion, pixel comparison, property listing and repeatable processing with every parameter on record.

Forensically is a free web page of image analysis tools that run inside the browser, so the picture never leaves the examiner's computer. It is a teaching and first-look tool, and its author says plainly that it cannot tell true from false.