Forensic tools directory
Independent profiles of the software and hardware used in digital investigations. Each one says what the tool is for, what it can do, where it stops and what you need to know before you use it on a case.
- Computer forensicsCurrentMagnet AxiomMagnet Forensics
Axiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.
- Computer forensicsCurrentMagnet Axiom CyberMagnet Forensics
Axiom Cyber is the Axiom variant for organisations rather than police. It adds remote collection from Windows, Mac and Linux endpoints, including machines that are off the corporate network. It can be hosted in AWS or Azure.
- Computer forensicsCurrentOpenText Forensic (EnCase)OpenText
EnCase Forensic, one of the oldest names in computer forensics, is now called OpenText Forensic (EnCase). OpenText says it is the same product, renamed to fit its cybersecurity portfolio.
- Computer forensicsCurrentExterro FTK Forensic ToolkitExterro
FTK is the Forensic Toolkit that AccessData built and Exterro has owned since late 2020. Today Exterro sells it as Exterro FTK in a standalone form and as FTK Central for teams, with FTK Imager alongside.
- Computer forensicsCurrentExterro FTK ImagerExterro
FTK Imager is the free tool most learners meet first. It makes forensic images of drives, folders and memory, verifies them with hashes and lets an examiner preview evidence before committing to a full acquisition.
- Computer forensicsCurrentX-Ways ForensicsX-Ways Software Technology AG
X-Ways Forensics is the German examination tool that runs light, starts fast and gives the examiner the raw disk alongside the parsed view. Version 21.9 was current when this page was checked.
- Computer forensicsCurrentBelkasoft X ForensicBelkasoft
Belkasoft X is a single tool for computer, mobile, drone, vehicle and cloud evidence. Belkasoft sells X Forensic to government customers and X Corporate to businesses, both on a perpetual licence.
- Computer forensicsCurrentAutopsySleuth Kit Labs
Autopsy is a free, open source examination platform that puts a graphical interface and ingest modules on top of The Sleuth Kit. For a student it is the first tool that shows a whole case from image to report at no cost.
- Computer forensicsCurrentThe Sleuth KitSleuth Kit Labs
The Sleuth Kit, usually written TSK, is a C library and a set of command line tools for examining disk images and file systems. Autopsy is its graphical face. Working with TSK directly teaches what the graphical tools hide.
- Computer forensicsCurrentOSForensicsPassMark Software
OSForensics is PassMark's Windows examination suite. It indexes and searches a drive or image, recovers deleted files, uncovers user activity and keeps everything in a case file, with a free edition for learning and paid editions for full use.
- Computer forensicsCurrentArsenal Image MounterArsenal Recon
Arsenal Image Mounter, or AIM, mounts a disk image in Windows as a complete disk rather than a share, so Windows itself sees partitions, shadow copies and BitLocker volumes. The free mode covers mounting; Professional Mode adds virtual machine launch and more.
- Computer forensicsTransitioningDigital Evidence InvestigatorADF Solutions
Digital Evidence Investigator, or DEI, is ADF's triage tool for computers and storage media. It scans a machine from a USB Collection Key, live or from boot, against prepared search profiles. ADF's site now leads with ADF PRO, which adds mobile devices. The DEI page is marked for customer renewals.
How to read a profile
Every profile was written from the maker’s own documentation and checked on the date shown. Where a page did not state something, such as the operating system or a licence term, the field is left empty rather than guessed. Product status matters: tool families change names, and a page that calls a product current, legacy or transitioning saves you learning something that is already being replaced.
The profiles are educational. They do not say that one product is better than another and they do not promise results. A tool only does what the examiner understands, so each profile lists the knowledge you need first and the DFRTI courses that teach it.
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.