Jump to navigation Jump to search
Function definition: Tools that support forensics related functions.
Lifecycle stage: Cross-Lifecycle Functions

Tools for this function

AFFLIBThe Advanced Forensics Format (AFF) and AFF Library (AFFLIB) are a joint development project of Simson L.
Autopsy Digital ForensicsOpen source, free digital forensics tool
Autopsy Forensic BrowserGraphical interface to the command line digital investigation tools in The Sleuth Kit
Crazy-fast-image-scanA script to scan media very quickly to find out what kind of content it contains
DataLiftersuite of tools "designed to assist with Computer Forensics, Information Auditing, Information Security and Data Recovery"
Dc3dd for computer forensicsdc3dd is a patched version of GNU dd with a number of features useful for computer forensics.
Dcfldddcfldd is an enhanced version of GNU dd with features useful for forensics and security.
Digital Intelligence Forensic SoftwareDigital Intelligence Forensic Software
Disk2FDIDisk2FDI is a professional disk imaging software designed to create binary images of floppy disks to the Formatted Disk Image (FDI) file format, as well as sector-based standard formats.
EnCase ForensicEnCase Forensic (OpenText)
FBCD (Farmer's Boot CD)bootable CD with Linux and forensic tools
FCCU GNU/Linux Forensic Boot CDbootable CD with Linux and forensic tools
FTK (Forensic Toolkit)Forensic Toolkit (AccessData)
ForemostForemost is a console program to recover files based on their headers, footers, and internal data structures.
Forensic Acquisition UtilitiesA collection of utilities and libraries intended for forensic or forensic-related investigative use in a modern Microsoft Windows environment.
FqTool, language and decoders for working with binary data.
Freeware Hex Editor XVI32XVI32 is a freeware hex editor running under Windows 95, Windows 98, Windows NT, Windows 2000, and Windows XP.
GumshoeSearch interface for metadata extracted from forensic disk images.
HashKeeperDigital Evidence Laboratory specialists created the HashKeeper software in 1998 to expedite the analysis of electronic media by reducing the number of files to be analyzed during the course of an investigation.
Helix (e-fense)bootable CD with Linux and forensic tools
Hex WorkshopThe Hex Workshop Hex Editor by BreakPoint Software is a complete set of hexadecimal development tools for Microsoft Windows 2000 and later.
I2i2 is a provider of intelligence and investigation management software for law enforcement, defense, national security and private sector organizations.
ILookPIILookPI provides a fully programmable IDE environment with customizable tool capabilities.
Index.dat Analyzer v2.5Index.dat Analyzer is a tool to view, examine and delete contents of index.dat files.
InfinaDyneInfinaDyne's forensic products are focused on government and law enforcement examining various types of media and intent on collecting evidence in a thorough, secure and trustworthy manner.
KEA (Keyphrase Extraction Algorithm)KEA is an algorithm for extracting keyphrases from text documents.
LibewfLibewf is a library for support of the Expert Witness Compression Format (EWF), it support both the SMART (EWF-S01) and EnCase (EWF-E01) format.
MRU-BlasterMRU-Blaster is a program made to do one large task - detect and clean MRU (most recently used) lists on your computer.
McAfee Free ToolsFree Tools [See specifically Foresnic Tools]
Microsoft Office 2003 Add-in: Word Redaction v1.2Use the Word 2003 Redaction Add-in to hide text within Microsoft Office Word 2003 documents.
Microsoft Office 2003/XP Add-in: Remove Hidden DataWith this add-in you can permanently remove hidden data and collaboration data, such as change tracking and comments, from Microsoft Word, Microsoft Excel, and Microsoft PowerPoint files.
NSRL (National Software Reference Library)The NSRL provides a large data set of metadata on computer files which can be used to identify the files and their provenance
OCFA (Open Computer Forensics Architecture)Open Computer Forensics Architecture is a modular computer forensics framework.
OSFMountdisk image file mounting
ParabenParaben provides forensics tools.
ProdiscoverProdiscover provides a set of features and toolkits for Computer Forensics and Incident Response
PyFlagFLAG (Forensic and Log Analysis GUI) is an advanced forensic tool for the analysis of large volumes of log files and forensic investigations.
RAID (Real-time Analytical Intelligence Database)RAID is a relational database used to record key pieces of information and to quickly identify links among people, places, businesses, financial accounts, telephone numbers, and other investigative information.
RapidRedactThe RapidRedact product range provides fast, easy to use redaction tools for irreversibly blanking out (redacting) selected information, author's changes and hidden data from all electronic document types.
Redact-ItProvides Windows desktop and server redaction of PDF, Word, scanned TIFF images. Find, black out and remove content within documents, images or drawings.
RedaxRedax completely redacts (removes) text and graphics from the PDF page.
RegshotRegshot is an open-source (GPL) registry compare utility that allows you to quickly take a snapshot of your registry and then compare it with a second one - done after doing system changes or installing a new software product.
The Carve Path Zero-storage Library and filesystemLibCarvPath is a library for computer forensics carving tools.
The Sleuth KitCollection of command line computer forensics digital investigation tools.
WinHexWinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security.
Windows IR/CF ToolsWindows based forensic tools
YaraYARA is a tool that allows the identification of files that match user-defined textual or binary patterns

See also the tools list on the ForensicsWiki.