Digital Forensics
Digital forensics and incident response tools capture and analyze disk images, memory, and endpoint artifacts to investigate breaches, reconstruct attacker activity, and triage malware. Network packet capture and protocol analysis tools are in the network-monitoring category.
Software in Digital Forensics
12 toolsNo tools in this category match the selected filters.
| Tool | License | Platforms | Pricing |
|---|---|---|---|
| Autopsy Open-source graphical digital forensics platform built on The Sleuth Kit for disk image, file system, and web artifact analysis with timelines. | Apache-2.0 | Windows, Linux, macOS | Open Source |
| Chainsaw Applies Sigma and custom rules to Windows event logs and MFT records, and analyzes registry hives and SRUM data for rapid incident triage. | GPL-3.0-only | Linux, Windows, macOS | Open Source |
| Cyber Triage Automated endpoint forensics tool that collects artifacts and scores them for investigation. | Proprietary | Windows | Commercial |
| DFIR-IRIS Open source collaborative incident response platform for cases, timelines, evidence, and alerts. | LGPL-3.0-or-later | Linux, Web | Open Source |
| KAPE Kroll Artifact Parser and Extractor for rapid Windows triage that collects and parses registry, event log, and browser artifacts from live systems. | KAPE EULA (proprietary) | Windows | Free / Commercial |
| MemProcFS Memory forensics framework that mounts physical memory dumps and live memory as a virtual file system. | AGPL-3.0-or-later | Linux, macOS, Windows | Open Source |
| Plaso DFIR timeline generation engine that parses logs, disk images, and artifacts to create unified event timelines for incident investigations. | Apache-2.0 | Linux, macOS, Windows | Open Source |
| Redline Free endpoint investigation tool from FireEye that collects and analyzes memory, processes, and files to triage suspicious activity. | Proprietary freeware | Windows | Free |
| The Sleuth Kit C library and command-line tools for disk and file system forensics that parse NTFS, FAT, EXT, HFS, and APFS images to recover deleted files. | Common Public License 1.0 / IBM Public License / Apache-2.0 / GPL-2.0 / MIT / BSD-3-Clause (mixed) | Windows, Linux, macOS | Open Source |
| TheHive SOC case management platform, now freemium under StrangeBee after its open source era. | Proprietary | Linux, Web | Free / Commercial |
| Velociraptor Endpoint visibility and digital forensics tool using VQL queries to collect system artifacts and hunt threats across hosts. | AGPL-3.0-or-later | Linux, macOS, Windows, FreeBSD | Open Source |
| Volatility Free memory forensics framework that extracts processes, network connections, and injected code from RAM snapshots without OS profiles. | Volatility Software License (VSL) v1.0 | Windows, Linux, macOS | Free |
About Digital Forensics
Digital forensics and incident response (DFIR) tools capture and analyze digital evidence after a security incident. The category includes disk forensics tools that create and examine forensic disk images, memory forensics frameworks that extract processes, network connections, and injected code from RAM dumps, and malware sandboxes that execute suspicious files in isolated environments to observe their behavior. Incident response platforms collect artifacts from endpoints across an organization, letting analysts search for indicators of compromise at scale. Tools like Autopsy and The Sleuth Kit provide graphical and command-line interfaces for disk image analysis, while Volatility analyzes memory dumps with plugins that find injected code and system call table hooks. Sandboxes like CAPE execute malware samples and capture the files they create, modify, and delete, along with their network traffic. Triage collection tools gather forensic artifacts quickly: KAPE collects them from individual hosts, and Velociraptor queries many endpoints at once, which is necessary when incident scope is unknown. The category overlaps with detection engineering, since IOCs discovered during DFIR investigations feed back into detection rules for future prevention.
Covered Topics
In This Catalog
- This category lists 12 tools: 7 open source, 2 free, 2 free / commercial, and 1 commercial.
- By platform, 9 run on Linux, 10 on Windows, 7 on macOS, and 2 on the web.
- The most common license among the open-source tools is AGPL-3.0-or-later and Apache-2.0 (2 tools each).
Frequently Asked Questions
What is Digital Forensics?→
Digital forensics and incident response tools capture and analyze disk images, memory, and endpoint artifacts to investigate breaches, reconstruct attacker activity, and triage malware. Network packet capture and protocol analysis tools are in the network-monitoring category.
What topics does the Digital Forensics category cover?→
Disk Forensics, Memory Analysis & Acquisition, Malware Sandboxing & Triage, Endpoint Artifact Collection, Timeline Reconstruction
Which Digital Forensics tools are open source?→
7 of the 12 tools in this category are open source: Autopsy, Chainsaw, DFIR-IRIS, MemProcFS, Plaso, The Sleuth Kit, and Velociraptor.