Skip to content

Latest commit

 

History

History
44 lines (40 loc) · 5.37 KB

Forensics.md

File metadata and controls

44 lines (40 loc) · 5.37 KB
Raw

Open Source

Free and Closed-Source

Paid

Open Source

DEFT

DEFT is a Linux forensics tools which contains bundles of tools which are free and open source. Mostly used for Incident Response, Cyber Intelligence and Computer Forensics scenarios. Amongst others, it contains tools for Mobile Forensics, Network Forensics, Data Recovery, and Hashing.

DD Imaging Tools

DD tool is the Linux forensics tool which is used for imaging to external storage.Also, create bootable USB stick from ISO files of Linux Installation

Volatility

Volatility is the memory forensics framework and extensively used for incident response as well as malware analysis. By using this tool, you could dig information from running processes,registry hives,network sockets, network connection and DLLs.

CAINE

CAINE is the open source Linux distro created for digital forensics. It is basically provides an environment to integrate existing software tools as software modules in a user friendly manner.

LiME

A Loadable Kernel Module (LKM) which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.

Free and Closed-Source

HexEditorNeo

Hex Editor Neo is a binary files editing software utility for Windows. It's rich and handy set of features will help all software and hardware developers working with ASCII, hex, decimal, float, double and binary data.

Highly optimized performance, carefully tuned user interface among with new level of application stability will save a lot of your time, money and precious nerves while working with binary files.

Paid

EnCase

EnCase is the tool that is used for multi-purpose with many nice tools for several areas of the digital forensic process.It is used to gather data from various devices to unearth the evidences. It also produces a report based on the evidence.

Magnet AXIOM

A series of tools by Magnet Forensics, for every stage of the digital investigation process. It covers everything from SmartPhone Forensics to Case management, Magnet AXIOM's EXAMINE and PROCESS utilities guide the user throughout the whole triage process. Free trial link

AccessData Forensic Toolkit (FTK Imager)

FTK Imager is a data preview and imaging tool used to acquire data (evidence) in a forensically sound manner by creating copies of data without making changes to the original evidence. It is used by security organizations (including law enforcement) for post-incident procedures.

Cellebrite UFED

The Cellebrite 'Universal Forensic Extraction Device' (UFED) is a tool for mobile phone, smartphone, and PDA forensics. the UFED was compatible with over 2,500 mobile phones (including GSM, TDMA, CDMA, iDEN). The standard package containing several dozen phone cables. The UFED had an intergrated SIM reader, with Wireless connection options also being integrated, such as IR and Bluetooth.The UFED also supports native Apple iPOD Touch, and Apple iPHONE extraction on both 2G and 3G versions, as well as iOS4. This is clientless, and via a physical cable, and works on jailbroken and non-jailbroken devices. Subject data can be retrieved via logical extraction or via physical extraction (ie: hex dump). Moreover, all cable connectors from subject (source) side act as a write-blocker, being read only via the onboard hardware chipset. Extracted data includes basic handset data, the phonebook, SMS and MMS messages, SIM data, multimedia (e.g. images and videos stored on the phone), and time and date stamps.

Autopsy

Autopsy is a GUI-based open source digital forensic program to analyze hard drives and smart phones efficiently. It’s widely used by corporate examiners, military to investigate and some of the features are like Email analysis, File type detection, Photos recovery from memory card, Extract geolocation and camera information from JPEG files, Extract web activity from browser, Show system events in graphical interface, Timeline analysis, Extract data from Android – SMS, call logs, contacts, etc.