Digital Forensics
Digital forensics and incident response tools capture and analyze disk images, memory, and endpoint artifacts to investigate breaches, reconstruct attacker activity, and triage malware. Network packet capture and protocol analysis tools are in the network-monitoring category.
| Tool | License | Platforms | Pricing | Action |
|---|---|---|---|---|
| Autopsy | Apache-2.0 | Windows, Linux, macOS | Open Source | Profile→ |
| Chainsaw | GPL-3.0-only | Linux, Windows, macOS | Open Source | Profile→ |
| Cyber Triage | Proprietary | Windows | Commercial | Profile→ |
| DFIR-IRIS | LGPL-3.0-or-later | Linux, Web | Open Source | Profile→ |
| KAPE | Kroll End User License Agreement (proprietary) | Windows | Free / Commercial | Profile→ |
| MemProcFS | AGPL-3.0-or-later | Linux, Windows | Open Source | Profile→ |
| Plaso | Apache-2.0 | Linux, macOS, Windows | Open Source | Profile→ |
| Redline | Proprietary freeware | Windows | Free | Profile→ |
| The Sleuth Kit | Common Public License 1.0 / IBM Public License / GPL-2.0 / MIT / BSD-3-Clause (mixed) | Windows, Linux, macOS | Open Source | Profile→ |
| TheHive | Proprietary | Linux, Web | Freemium | Profile→ |
| Velociraptor | AGPL-3.0-or-later | Linux, macOS, Windows, FreeBSD | Open Source | Profile→ |
| Volatility | Volatility Software License (VSL) v1.0 | Windows, Linux, macOS | Free | Profile→ |
Software in Digital Forensics
Autopsy
Open SourceOpen-source graphical digital forensics platform built on The Sleuth Kit for disk image, file system, and web artifact analysis with timelines.
Chainsaw
Open SourceApplies Sigma and custom rules to search Windows event logs, MFT records, registry hives, and SRUM data for rapid incident triage.
Cyber Triage
CommercialAutomated endpoint forensics tool that collects artifacts and scores them for investigation.
DFIR-IRIS
Open SourceOpen source collaborative incident response platform for cases, timelines, evidence, and alerts.
KAPE
Free / CommercialKroll Artifact Parser and Extractor for rapid Windows triage that collects and parses registry, event log, and browser artifacts from live systems.
MemProcFS
Open SourceMemory forensics framework that mounts physical memory dumps and live memory as a virtual file system.
Plaso
Open SourceDFIR timeline generation engine that parses logs, disk images, and artifacts to create unified event timelines for incident investigations.
Redline
FreeFree endpoint investigation tool from FireEye that collects and analyzes memory, processes, and files to triage suspicious activity.
The Sleuth Kit
Open SourceC library and command-line tools for disk and file system forensics that parse NTFS, FAT, EXT, HFS+, and APFS images to recover deleted files.
TheHive
FreemiumSOC case management platform, now freemium under StrangeBee after its open source era.
Velociraptor
Open SourceEndpoint visibility and digital forensics tool using VQL queries to collect system artifacts and hunt threats across hosts.
Volatility
FreeFree memory forensics framework that extracts processes, network connections, and injected code from RAM snapshots without OS profiles.
Frequently Asked Questions
What is Digital Forensics?→
Digital forensics and incident response tools capture and analyze disk images, memory, and endpoint artifacts to investigate breaches, reconstruct attacker activity, and triage malware. Network packet capture and protocol analysis tools are in the network-monitoring category.
What topics does the Digital Forensics category cover?→
Disk Forensics, Memory Analysis & Acquisition, Malware Sandboxing & Triage, Endpoint Artifact Collection, Timeline Reconstruction
About Digital Forensics
Digital forensics and incident response (DFIR) tools capture and analyze digital evidence after a security incident. The category includes disk forensics tools that create and examine forensic disk images, memory forensics frameworks that extract processes, network connections, and injected code from RAM dumps, and malware sandboxes that execute suspicious files in isolated environments to observe their behavior. Incident response platforms collect artifacts from endpoints across an organization, letting analysts search for indicators of compromise at scale. Tools like Autopsy and The Sleuth Kit provide graphical and command-line interfaces for disk image analysis, while Volatility processes memory dumps to reconstruct running processes and detect rootkits. Sandboxes like CAPE execute malware samples and produce reports on file system changes, network communications, and registry modifications. Endpoint collection tools like KAPE and Velociraptor gather forensic artifacts rapidly across thousands of machines, which is necessary when incident scope is unknown. The category overlaps with detection engineering, since IOCs discovered during DFIR investigations feed back into detection rules for future prevention.
Covered Topics & Disciplines
Related Security Categories
Disassemblers, binary decompilers, and dynamic execution analyzers.
SIEM platforms, EDR agents, SOAR automation, and detection rule engines for security operations.
Threat intelligence platforms, IOC sharing communities, and STIX/TAXII tooling for collecting and distributing threat data.