Forensic tools directory
Independent profiles of the software and hardware used in digital investigations. Each one says what the tool is for, what it can do, where it stops and what you need to know before you use it on a case.
- Network and enterpriseCurrentWiresharkWireshark Foundation
Wireshark captures network traffic and shows every packet decoded field by field. It is the standard first tool for reading a packet capture in an investigation.
- Network and enterpriseCurrentNetworkMinerNetresec
NetworkMiner reads a packet capture and sorts what it finds by host, file, session and credential. It is the tool to open when the question is what happened on the wire rather than which flag was set in which packet.
- Network and enterpriseCurrentZeekThe Zeek Project
Zeek watches a network link and writes what it sees as structured logs rather than packets. For a forensic analyst that means hours of traffic become tables that can be searched, joined and placed on a timeline.
- Network and enterpriseCurrenttcpdump and libpcapThe Tcpdump Group
tcpdump captures packets from the command line and libpcap is the library it and many other programs use to do it. Between them they define the pcap format that network forensics is built on.
- Network and enterpriseCurrentArkimeArkime project
Arkime stores packets at scale and indexes the sessions they belong to, so an analyst can search weeks of traffic by field and pull back the exact packets in seconds.
- Network and enterpriseCurrentVelociraptorRapid7
Velociraptor puts a small agent on endpoints and lets an examiner ask them questions in a query language. A hunt sends the same question to every machine and the answers come back as tables.
- Network and enterpriseCurrentPlasolog2timeline project
Plaso pulls every timestamp it can recognise out of a disk image or folder and writes them to one storage file. Sorted, that file is the super timeline investigators use to see what happened in what order.
- Network and enterpriseCurrentTimesketchGoogle (open source project)
Timesketch is a web application where several analysts work on the same timeline. Events from Plaso or CSV go into a sketch and the team searches, tags, comments and builds its account of events from them.
- Network and enterpriseCurrentKAPE (Kroll Artifact Parser and Extractor)Kroll
KAPE copies the files an examiner needs from a Windows system or image in minutes and then runs other programs over them. It is the quickest route from a live machine to parsed artefacts.
- Network and enterpriseCurrentEric Zimmerman's ToolsEric Zimmerman
A set of free, signed Windows forensic utilities, one per artefact, that turn registry hives, the master file table, event logs, prefetch, shellbags and jump lists into CSV an examiner can read in Timeline Explorer.
How to read a profile
Every profile was written from the maker’s own documentation and checked on the date shown. Where a page did not state something, such as the operating system or a licence term, the field is left empty rather than guessed. Product status matters: tool families change names, and a page that calls a product current, legacy or transitioning saves you learning something that is already being replaced.
The profiles are educational. They do not say that one product is better than another and they do not promise results. A tool only does what the examiner understands, so each profile lists the knowledge you need first and the DFRTI courses that teach it.
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.