Forensic tools directory
Independent profiles of the software and hardware used in digital investigations. Each one says what the tool is for, what it can do, where it stops and what you need to know before you use it on a case.
How to read a profile
Every profile was written from the maker’s own documentation and checked on the date shown. Where a page did not state something, such as the operating system or a licence term, the field is left empty rather than guessed. Product status matters: tool families change names, and a page that calls a product current, legacy or transitioning saves you learning something that is already being replaced.
The profiles are educational. They do not say that one product is better than another and they do not promise results. A tool only does what the examiner understands, so each profile lists the knowledge you need first and the DFRTI courses that teach it.
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.