Scribd
Upload
244 views9 pages

100 Free Tools for Forensic Investigators

This document lists and summarizes 100 free security tools useful for ethical hackers and forensic investigators. The tools cover a wide range of purposes including digital forensics, network forensics, malware analysis, memory analysis, disk imaging and recovery, mobile device analysis, and more. Many are open source while some are commercial. Platforms include Windows, Linux, and mobile.

Uploaded by

wenijo4171
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
244 views9 pages

100 Free Tools for Forensic Investigators

This document lists and summarizes 100 free security tools useful for ethical hackers and forensic investigators. The tools cover a wide range of purposes including digital forensics, network forensics, malware analysis, memory analysis, disk imaging and recovery, mobile device analysis, and more. Many are open source while some are commercial. Platforms include Windows, Linux, and mobile.

Uploaded by

wenijo4171
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
  • Introduction
  • Comprehensive List of Security Tools
  • Digital Forensics Frameworks
  • Disk Forensics
  • Memory Forensics
  • Carving Tools
  • Phone Extraction Tools
  • Hex Editors
  • Windows Artifact Analysis
  • Data Recovery Tools
  • Data Extraction Tools
  • Specialized Tools
  • Outro
  • OSINT Tools

100 Free Security Tools

For ethical hackers and forensic investigators

INSIDE CLOUD
100 Free Security Tools
For ethical hackers and forensic investigators

1. Autopsy - Open source digital forensics platform to analyze hard drives and smart phones
[Link]
2. EnCase - Commercial computer forensics software for e-discovery and investigations by OpenText
[Link]
3. AccessData (FTK) - Forensic toolkit computer investigation software by AccessData
[Link]
4. X-Ways Forensics - Integrated computer forensics software by X-Ways Software Technology [Link]
[Link]/forensics/
5. Sleuth Kit - Open source digital forensics tools for analyzing disk images and file systems
[Link]
6. Volatility - Memory forensics framework to analyze volatile memory dumps and artifacts
[Link]
7. Wireshark - Network protocol analyzer useful for network forensics and traffic analysis
[Link]
8. Cellebrite UFED - Commercial mobile forensic software to extract data from phones and tablets
[Link]
9. Email Collector - Tool to collect and analyze email data during investigations
[Link]
10. Forensics (DFF) - Digital forensics framework, an open source platform for investigations
[Link]
11. Magnet AXIOM - Commercial digital investigations platform from Magnet Forensics
[Link]
12. Oxygen Detective - Cloud extraction tool for investigations involving cloud services [Link]
[Link]/en/oxygen-detective
13. OSForensics - Specialized forensics tools for Microsoft systems from PassMark
[Link]
14. NetworkMiner - Open source network forensic analyzer useful for investigating traffic
[Link]
15. RegRipper - Tool to parse Windows registry files and dig for useful data
[Link]
16. Bulk Extractor - Scans disk images and extract interesting bits of data
[Link]
17. Ghiro - Web site screenshots and analysis for forensic investigations [Link]
18. Scalpel - File carver which recovers files based on headers and footers
[Link]
19. HxD - Hex editor useful for analyzing raw disk and memory dumps [Link]
20. TestDisk - Data recovery tool, useful when file systems get corrupted
[Link]
21. PhotoRec - Recovery tool specifically focused on photos and media files
[Link]
22. CAINE - Italian GNU/Linux live distribution with many forensics tools [Link]
23. Axiom Cyber - Commercial digital forensics and incident response platform
[Link]
24. Belkasoft Evidence - Commercial all-in-one forensics solution for Windows, mobile etc
[Link]
25. Fibratus - Tool to explore and trace Windows kernel activity and data
[Link]
26. Autopsy Browser - GUI interface for autopsy digital forensics platform
[Link]
27. Kali Linux - Penetration testing Linux distribution with many useful security tools [Link]
28. DEFT - Linux distribution configured specifically for computer forensics [Link]
29. Volatility Framework - Advanced memory forensics framework with plugins and APIs
[Link]
30. PyFlag - Legacy Australian forensic and log analysis GUI platform [Link]
100 Free Security Tools
For ethical hackers and forensic investigators

31. Plaso (log2timeline) - Extract timestamps from various logs and aggregate timeline
[Link]
32. TSK (The Sleuth Kit) - File system and disk analysis tools originally focussed on NTFS
[Link]
33. Redline - Host investigations and malware analysis tool by FireEye
[Link]
34. Snort - Open source intrusion detection and network monitoring system [Link]
35. Tcpdump - Capture and analyze network traffic on Unix-like systems [Link]
36. Ngrep - Search within network traffic payloads like grep for text streams [Link]
37. dcfldd - Disk cloning and forensics tool, version of dd with hashing [Link]
38. Wireshark - Network traffic analyzer useful for network forensics [Link]
39. SIFT (SANS) - Ubuntu-based distribution for forensic analysis [Link]
[Link]/community/downloads
40. Paladin - USB image mounted as virtual drive with write-protection
[Link]
41. CAINE Live - Self-contained bootable forensic environment [Link]
42. XRY (XAMN) - Commercial mobile forensic software to analyze phones [Link]
43. BlackLight - Powerful Windows-based forensics analysis platform
[Link]
44. WinHex - Hex editor, particularly helpful for low-level analyzing raw data [Link]
[Link]/winhex/
45. Access FTK Imager - Disk and volume imaging software from AccessData [Link]
download
46. DC3DD - Improved version of dd for forensics, handles errors better [Link]
Crime-Center/DC3-DD
47. Raptor - Validation tool to verify integrity of forensic copies [Link]
48. EnCase Imager - Disk imaging tool from Guidance Software [Link]
imager
49. Guymager - Open source disk cloning and imaging tool for Linux [Link]
50. Scalpel - File carver recovering files based on header/footer signatures
[Link]
51. Extundelete - Used to recover deleted files from mountable images [Link]
52. Xplico - Network forensics tool that rebuilds sessions from traffic [Link]
53. Foremost - File carving utility to recover files using header/footer definitions
[Link]
54. Hunchback - High speed packet capture and transmission tool [Link]
55. Autopsy Tools - Plugins and tools used alongside Autopsy forensics GUI
[Link]
56. OSForensics Imager - Hardware write block tool for connecting devices
[Link]
57. Dislocker - Decrypts Bitlocker encrypted volumes with mounted filesystem
[Link]
58. Bulk Extractor - Extract forensically interesting information from disk images
[Link]
59. SANS SIFT - Ubuntu-derived distro for digital forensic analysis [Link]
[Link]/community/downloads
60. Live View - Volatile memory analysis tool for Windows systems [Link]
61. LRR - Tool for viewing Windows artifacts including LNK files
[Link]
62. NTFS-3G - Open source cross-platform NTFS driver with write support
[Link]
63. WindowsSCOPE - Registry analysis tool for dumped SYSTEM/SAM/SECURITY hives
[Link]
64. Volafax - Forensic system suited for investigations over remote areas
[Link]
100 Free Security Tools
For ethical hackers and forensic investigators

65. Amcache Parser - Recovers data from Windows 10 [Link] artifact file
[Link]
66. The Hive - Web interface offering querying capabilities for hive files [Link]
67. GRR Rapid Response - Incident response framework focused on remote live forensics
[Link]
68. Rekall - Advanced forensic memory analysis framework powered by Python [Link]
[Link]/
69. DFF - Open source digital forensics framework and platform written in Python
[Link]
70. SSDeep - Fuzzy hashing tool used for malware clustering and piecewise comparisons [Link]
[Link]/ssdeep/[Link]
71. KAPE - Target acquisition tool focused on enterprise lines of business [Link]
72. USB Write Blocker - Hardware ensuring write protection when imaging USB devices
73. AIL - Network and host monitoring system for identification of intrusions [Link]
management/products-services/[Link]
74. Rifiuti2 - Analyzes Windows Recycle Bin INFO2 files and recovers filenames
[Link]
75. VolDiff - Compares memory images and highlights differences for analysis [Link]
76. WinAudit - Scans Windows systems and reports changes from baseline [Link]
77. hfind - Carves unallocated space and extracts hidden/deleted data into files
[Link]
78. Yara - Pattern matching tool aimed at malware researchers
79. Checkm8 - Jailbreaking tool extracting data from passcode locked iOS devices [Link]
80. Olefile - Python package for parsing OLE and Office documents [Link]
81. Pyew - Python tool for malware analysis static and dynamic [Link]
82. E01 Examiner - Software utility for mounting EnCase evidence file formats [Link]
83. USBDeview - Handy Windows tool listing all USB devices ever connected
[Link]
84. Autopsy - iPhone - Autopsy module adds iOS analysis functionality
[Link]
85. DC3-MWCP - Collection of tools for forensic enterprise analysis from DC3 [Link]
catalog/
86. X-Ways Imager - Disc imaging tool to create forensic images, integrated into X-Ways Forensics
[Link]
87. Memoryze - Memory acquisition and analysis tool for Windows systems
[Link]
88. EVTExtract - Automated parsing modules for Windows event log records
[Link]
89. Speedit - Detection and analysis of spyware, keyloggers, trojans etc [Link]
90. SniffPass - Sniffs passwords and other sensitive information from a network
[Link]
91. Nmap - Network scanning and host discovery tool helpful for reconnaissance [Link]
92. OSINT Framework - Gathering publicly available online data regarding targets [Link]
93. Recon-ng - Web based open source reconnaissance framework [Link]
94. OSINT-SPY - Performs extensive reconnaissance using 300+ OSINT data sources
[Link]
95. Shodan - Search engine for Internet connected devices [Link]
96. Maltego - Link analysis and data mining for gathering information [Link]
97. SpiderFoot - OSINT automation tool gathering threat intelligence data [Link]
98. Metagoofil - Extract metadata of public documents from a target website
[Link]
99. TheHarvester - Gather emails, names, URLs from different public sources
[Link]
100. Creepy - Geolocation OSINT tool to extract target location information from social media profiles
[Link]
100 Free Security Tools
For ethical hackers and forensic investigators

Here are those same 100 resources, grouped by function.

Digital Forensics Frameworks:


1. Autopsy - Open source digital forensics platform to analyze hard drives and smart phones
[Link]
10. Forensics (DFF) - Digital forensics framework, an open source platform for investigations
[Link]
22. CAINE - Italian GNU/Linux live distribution with many forensics tools
[Link]
26. Autopsy Browser - GUI interface for autopsy digital forensics platform
[Link]
27. Kali Linux - Penetration testing Linux distribution with many useful security tools
[Link]
28. DEFT - Linux distribution configured specifically for computer forensics
[Link]
29. Volatility Framework - Advanced memory forensics framework with plugins and APIs
[Link]
39. SIFT (SANS) - Ubuntu-based distribution for forensic analysis
[Link]
41. CAINE Live - Self-contained bootable forensic environment
[Link]
59. SANS SIFT - Ubuntu-derived distro for digital forensic analysis
[Link]
68. Rekall - Advanced forensic memory analysis framework powered by Python
[Link]

Disk Forensics:
2. EnCase - Commercial computer forensics software for e-discovery and investigations by OpenText
[Link]
3. AccessData (FTK) - Forensic toolkit computer investigation software by AccessData
[Link]
4. X-Ways Forensics - Integrated computer forensics software by X-Ways Software Technology
[Link]
5. Sleuth Kit - Open source digital forensics tools for analyzing disk images and file systems
[Link]
30. PyFlag - Legacy Australian forensic and log analysis GUI platform
[Link]
32. TSK (The Sleuth Kit) - File system and disk analysis tools originally focussed on NTFS
[Link]
42. XRY (XAMN) - Commercial mobile forensic software to analyze phones [Link]
43. BlackLight - Powerful Windows-based forensics analysis platform
[Link]
44. WinHex - Hex editor, particularly helpful for low-level analyzing raw data
[Link]
45. Access FTK Imager - Disk and volume imaging software from AccessData
[Link]
46. DC3DD - Improved version of dd for forensics, handles errors better
[Link]
47. Raptor - Validation tool to verify integrity of forensic copies
[Link]
48. EnCase Imager - Disk imaging tool from Guidance Software
[Link]
49. Guymager - Open source disk cloning and imaging tool for Linux [Link]
100 Free Security Tools
For ethical hackers and forensic investigators

Memory Forensics:
6. Volatility - Memory forensics framework to analyze volatile memory dumps and artifacts
[Link]
29. Volatility Framework - Advanced memory forensics framework with plugins and APIs
[Link]
60. Live View - Volatile memory analysis tool for Windows systems [Link]
68. Rekall - Advanced forensic memory analysis framework powered by Python [Link]
[Link]/
75. VolDiff - Compares memory images and highlights differences for analysis
[Link]
87. Memoryze - Memory acquisition and analysis tool for Windows systems
[Link]

Carving Tools:
16. Bulk Extractor - Scans disk images and extract interesting bits of data
[Link]
18. Scalpel - File carver which recovers files based on headers and footers
[Link]
50. Scalpel - File carver recovering files based on header/footer signatures
[Link]
51. Extundelete - Used to recover deleted files from mountable images [Link]
52. Xplico - Network forensics tool that rebuilds sessions from traffic [Link]
53. Foremost - File carving utility to recover files using header/footer definitions
[Link]
55. Autopsy Tools - Plugins and tools used alongside Autopsy forensics GUI
[Link]
57. Dislocker - Decrypts Bitlocker encrypted volumes with mounted filesystem
[Link]
58. Bulk Extractor - Extract forensically interesting information from disk images
[Link]
77. hfind - Carves unallocated space and extracts hidden/deleted data into files
[Link]

Network Monitoring:
7. Wireshark - Network protocol analyzer useful for network forensics and traffic analysis
[Link]
14. NetworkMiner - Open source network forensic analyzer useful for investigating traffic
[Link]
34. Snort - Open source intrusion detection and network monitoring system [Link]
35. Tcpdump - Capture and analyze network traffic on Unix-like systems [Link]
36. Ngrep - Search within network traffic payloads like grep for text streams [Link]
38. Wireshark - Network traffic analyzer useful for network forensics [Link]
54. Hunchback - High speed packet capture and transmission tool [Link]
73. AIL - Network and host monitoring system for identification of intrusions [Link]
management/products-services/[Link]
100 Free Security Tools
For ethical hackers and forensic investigators

Windows Artifact Analysis:


15. RegRipper - Tool to parse Windows registry files and dig for useful data
[Link]
25. Fibratus - Tool to explore and trace Windows kernel activity and data
[Link]
61. LRR - Tool for viewing Windows artifacts including LNK files
[Link]
62. NTFS-3G - Open source cross-platform NTFS driver with write support
[Link]
63. WindowsSCOPE - Registry analysis tool for dumped SYSTEM/SAM/SECURITY hives
[Link]
65. Amcache Parser - Recovers data from Windows 10 [Link] artifact file
[Link]
66. The Hive - Web interface offering querying capabilities for hive files [Link]
74. Rifiuti2 - Analyzes Windows Recycle Bin INFO2 files and recovers filenames
[Link]
76. WinAudit - Scans Windows systems and reports changes from baseline [Link]
83. USBDeview - Handy Windows tool listing all USB devices ever connected
[Link]
85. DC3-MWCP - Collection of tools for forensic enterprise analysis from DC3 [Link]
catalog/
88. EVTExtract - Automated parsing modules for Windows event log records
[Link]

Hex Editors:
19. HxD - Hex editor useful for analyzing raw disk and memory dumps [Link]
44. WinHex - Hex editor, particularly helpful for low-level analyzing raw data [Link]
[Link]/winhex/

Data Extraction Tools:


8. Cellebrite UFED - Commercial mobile forensic software to extract data from phones and tablets
[Link]
9. Email Collector - Tool to collect and analyze email data during investigations
[Link]
11. Magnet AXIOM - Commercial digital investigations platform from Magnet Forensics
[Link]
12. Oxygen Detective - Cloud extraction tool for investigations involving cloud services [Link]
[Link]/en/oxygen-detective
13. OSForensics - Specialized forensics tools for Microsoft systems from PassMark
[Link]
23. Axiom Cyber - Commercial digital forensics and incident response platform
[Link]
24. Belkasoft Evidence - Commercial all-in-one forensics solution for Windows, mobile etc
[Link]
31. Plaso (log2timeline) - Extract timestamps from various logs and aggregate timeline
[Link]
33. Redline - Host investigations and malware analysis tool by FireEye
[Link]
37. dcfldd - Disk cloning and forensics tool, version of dd with hashing [Link]
100 Free Security Tools
For ethical hackers and forensic investigators

Data Extraction Tools (continued):


40. Paladin - USB image mounted as virtual drive with write-protection
[Link]
56. OSForensics Imager - Hardware write block tool for connecting devices
[Link]
64. Volafax - Forensic system suited for investigations over remote areas
[Link]
67. GRR Rapid Response - Incident response framework focused on remote live forensics
[Link]
69. DFF - Open source digital forensics framework and platform written in Python
[Link]
70. SSDeep - Fuzzy hashing tool used for malware clustering and piecewise comparisons [Link]
[Link]/ssdeep/[Link]
71. KAPE - Target acquisition tool focused on enterprise lines of business
[Link]
79. Checkm8 - Jailbreaking tool extracting data from passcode locked iOS devices [Link]
80. Olefile - Python package for parsing OLE and Office documents [Link]
84. Autopsy - iPhone - Autopsy module adds iOS analysis functionality
[Link]

Data Recovery Tools:


20. TestDisk - Data recovery tool, useful when file systems get corrupted
[Link]
21. PhotoRec - Recovery tool specifically focused on photos and media files
[Link]

Specialized Tools:
17. Ghiro - Web site screenshots and analysis for forensic investigations [Link]
81. Pyew - Python tool for malware analysis static and dynamic [Link]
82. E01 Examiner - Software utility for mounting EnCase evidence file formats [Link]
86. X-Ways Imager - Disc imaging tool to create forensic images, integrated into X-Ways Forensics
[Link]
89. Speedit - Detection and analysis of spyware, keyloggers, trojans etc [Link]
sdk
90. SniffPass - Sniffs passwords and other sensitive information from a network
[Link]

OSINT Tools:
91. Nmap - Network scanning and host discovery tool helpful for reconnaissance [Link]
92. OSINT Framework - Gathering publicly available online data regarding targets
[Link]
93. Recon-ng - Web based open source reconnaissance framework [Link]
ng
94. OSINT-SPY - Performs extensive reconnaissance using 300+ OSINT data sources
[Link]
95. Shodan - Search engine for Internet connected devices [Link]
96. Maltego - Link analysis and data mining for gathering information [Link]
97. SpiderFoot - OSINT automation tool gathering threat intelligence data [Link]
98. Metagoofil - Extract metadata of public documents from a target website
[Link]
100 Free Security Tools
For ethical hackers and forensic investigators

OSINT Tools (continued):


91. Nmap - Network scanning and host discovery tool helpful for reconnaissance [Link]
92. OSINT Framework - Gathering publicly available online data regarding targets
[Link]
93. Recon-ng - Web based open source reconnaissance framework [Link]
ng
94. OSINT-SPY - Performs extensive reconnaissance using 300+ OSINT data sources
[Link]
95. Shodan - Search engine for Internet connected devices [Link]
96. Maltego - Link analysis and data mining for gathering information [Link]
97. SpiderFoot - OSINT automation tool gathering threat intelligence data [Link]
98. Metagoofil - Extract metadata of public documents from a target website
[Link]
99. TheHarvester - Gather emails, names, URLs from different public sources
[Link]
100. Creepy - Geolocation OSINT tool to extract target location information from social media profiles
[Link]

FOLLOW ME ON:
(click icon below)

INSIDE CLOUD

Common questions

Powered by AI

Autopsy is an open-source digital forensics platform primarily used for analyzing hard drives and smartphones. It features a user-friendly GUI interface and supports various plugins that extend its capabilities for comprehensive investigations. CAINE, on the other hand, is a live GNU/Linux distribution equipped with a wide array of pre-installed forensic tools, designed for examining devices in a bootable environment without altering the data. These platforms integrate with other tools such as The Sleuth Kit and Volatility, providing a versatile environment for forensic analysis .

Autopsy and DFF (Digital Forensics Framework) are both open-source platforms used in digital investigations, but they differ in design and application. Autopsy provides a GUI that simplifies the user experience, driving ease of use through visualization of forensic processes. It is particularly effective in cases where efficiency and user-friendliness are paramount. DFF, by contrast, is noted for its flexibility and extensibility, offering command-line operations that appeal to advanced users seeking tailored solutions. This distinction means Autopsy is preferred for standard, quick-to-deploy investigations, whereas DFF might be chosen for more customizable, complex cases .

The SIFT workstation is a Linux-based toolkit designed for advanced digital forensic tasks. It includes a collection of specialized tools for file system and disk analysis, memory forensics, and even network traffic examination. Key components include The Sleuth Kit for disk analysis, Volatility for memory examination, and Bulk Extractor for pattern recognition in data. Its ease of use and integration of a broad set of forensic tools make it invaluable for comprehensive investigations .

The Volatility framework is designed specifically for memory forensics. It offers advanced features such as plugins and APIs that enhance analysis of volatile memory dumps. These tools allow forensic investigators to extract artifacts from live systems, analyze the contents of memory, and identify malware or suspicious activity. Its comprehensive support for different data types and structures in memory contributes to its robust forensic capabilities .

GUI interfaces in tools like Autopsy provide a more intuitive and accessible means for users to conduct forensic investigations. These interfaces facilitate easier navigation through complex datasets, allowing investigators to manage evidence, analyze data patterns, and collaborate with others more effectively. The drag-and-drop features and visual summaries reduce the learning curve associated with command-line tools, making forensic capabilities accessible to a broader range of users while enhancing the speed and accuracy of the investigations .

FTK Imager and EnCase Imager are both used for creating forensic disk images. FTK Imager is known for its speed and ability to preview and analyze data before imaging, making it useful for quick assessments. EnCase Imager, part of the EnCase suite, is highly regarded for its expansive support for evidence file formats and integration with the EnCase forensic analysis workflow. EnCase Imager also facilitates the generation of detailed reports based on the imaged data, which can be crucial in formal investigations .

SSDeep utilizes fuzzy hashing to perform similarity comparisons between files, which is particularly useful in malware analysis for clustering. Unlike standard hashing, which generates a unique hash for each file, fuzzy hashing can identify partial file matches, indicating similar content between files. This makes SSDeep valuable for detecting variants of malware that might share common segments or patterns, offering insights not achievable with traditional hash functions .

Wireshark is a powerful network protocol analyzer that allows users to capture and investigate live network traffic. Its strength lies in its ability to parse and display packet details at multiple layers, which is essential for deep traffic analysis. Xplico, on the other hand, is specialized in reconstructing session data from captured network traffic, allowing investigators to view reconstructed communications like emails and VoIP calls. While Wireshark provides detailed packet-level insights, Xplico excels in session reconstruction, making them complementary tools in network forensics .

OSINT-SPY is a cutting-edge reconnaissance tool that combines over 300 OSINT data sources, enabling thorough intelligence gathering. Unlike traditional OSINT tools which may focus on specific data types or sources, OSINT-SPY offers extensive integration of multiple platforms and data streams. This comprehensive access allows users to gather diverse information, including domain data, social media footprints, and publicly available reports, all in a single, sophisticated tool .

RegRipper is a specialized tool used for extracting and parsing Windows registry files, essential components in forensic investigations of Windows systems. It can extract a wide range of data, including user account information, system metadata, recently accessed files, USB device history, and more. By automating the process of sifting through registry hives, RegRipper accelerates the identification of evidence and anomaly detection, which aids investigators in building a comprehensive view of system activity .

100 Free Security Tools For ethical hackers and forensic investigators INSIDE CLOUD
1. Autopsy - Open source digital forensics platform to analyze hard drives and smart phones https://www.autopsy.com 2. EnCas
31. Plaso (log2timeline) - Extract timestamps from various logs and aggregate timeline https://plaso.readthedocs.io/en/lates
65. Amcache Parser - Recovers data from Windows 10 Amcache.hve artifact file https://tzworks.net/prototype_page.php?proto_id
Here are those same 100 resources, grouped by function. Digital Forensics Frameworks: 1. Autopsy - Open source digital forens
Memory Forensics: 6. Volatility - Memory forensics framework to analyze volatile memory dumps and artifacts https://www.vola
Windows Artifact Analysis: 15. RegRipper - Tool to parse Windows registry files and dig for useful data https://github.com/k
Data Extraction Tools (continued): 40. Paladin - USB image mounted as virtual drive with write-protection https://sumuri.com
OSINT Tools (continued): 91. Nmap - Network scanning and host discovery tool helpful for reconnaissance https://nmap.org/ 92.

You might also like