Forensic Computer Tools for Hackers and Security Professionals

Computer forensic tools are most commonly used by security industries to test vulnerabilities in the network and applications by gathering evidence to find an indicator of commitment and take appropriate mitigation measures.

Here you can find the complete list of forensic computer tools that covers conducting forensic analysis and responding to incidents throughout the environment.

Collection of Computer Forensic Tools

• DFIR - The definitive compendium project  - Collection of resources for forensic analysis for learning and research. Offers lists of certifications, books, blogs, challenges and more.
• dfir.training  - Forensic resources database focused on events, tools and more.
• ForensicArtifacts.com Artifact Repository

Tools

• Free computer forensic tools
• Forensics tools on Wikipedia

Distributions

• bitscout  - LiveCD / LiveUSB for remote forensic acquisition and analysis.
• deft  - Linux distribution for forensic analysis.
• SANS Investigative Forensics Toolkit (sift)  - Linux distribution for forensic analysis.

Frameworks

• Laika BOSS  - Laika is an object scanner and an intrusion detection system.
• The Sleuth Kit  - Tools for low level forensic analysis.
• turbinia  - Turbinia is an open source framework for implementing, managing and executing forensic workloads on cloud platforms.
• dff
• IntelMQ
• PowerForensics

Images

• dc3dd  - Improved version of dd.
• dcfldd  - Different improved version of dd (this version has some bugs, another version in github  adulau / dcfldd ).
• FTK Imager
• Guymager

Carving

• bulk_extractor  - Extracts information such as email addresses, credit card numbers and disk image histograms.
• photorec  - File carving (tool).
• bstrings
• floss

See more in  Malware Analysis List

Forensic Memory

• inVtero.net
• KeeFarce
• Rekall
• volatility
• VolUtility
• BlackLight
• DAMM
• evolve
• FindAES
• inVtero.net
• Muninn
• Rekall
• TotalRecall
• VolDiff
• Volatility
• VolUtility
• WDBGARK
• WinDbg

See more in  Malware Analysis List

Forensic Analysis of the Network

• SiLK Tools  - SiLK is a set of analysis tools for network traffic collection and forensic computer analysis.
• Wireshark  - Network traffic analysis tool.
• NetLytics

Windows artifacts

• ArtifactExtractor
• FastIR Collector
• FRED
• LogonTracer
• MFT-Parsers
• MFTExtractor
• NTFS journal parser
• NTFS USN Journal parser
• RecoverBit
• python-ntfs

Forensic Analysis in Mac OS X Systems

• OSXAuditor

Internet artifacts

• chrome-url-dumper
• hindsight

Time Line Analysis

• DFTimewolf
• plase
• timesketch

Disc Image Management

• aff4
• imagemounter
• libewf
• xmount

Decoded

• hashcat  - Password Cracker.
• John the Ripper  - Password Cracker.

CTFs

• Forensics CTFs
• Precision Widgets of North Dakota Intrusion

books

• Network Forensics: Tracking Hackers through Cyberspace
• The Art of Memory Forensics
• The Practice of Network Security Monitoring

Others

• / r / computerforensics /
• ForensicPosters
• Forensic challanges
• Training material