Feb 15 2024

5 free digital forensics tools to boost your investigations

Category: Forensics,Security Tools — disc7 @ 2:19 pm
5 free digital forensics tools to boost your investigations

Digital forensics plays a crucial role in analyzing and addressing cyberattacks, and it’s a key component of incident response. Additionally, digital forensics provides vital information for auditors, legal teams, and law enforcement agencies in the aftermath of an attack.

Many cutting-edge digital forensics tools are on the market, but for those who cannot afford them, here’s a list of great free solutions to get you started.

Autopsy

Autopsy is a digital forensics platform widely employed by law enforcement agencies, military personnel, and corporate investigators to examine and understand activities on a computer. Although Autopsy is designed to be cross-platform, the latest version is fully functional and tested only on Windows.

digital forensics tools

bulk_extractor

bulk_extractor is a high-speed tool for digital forensics analysis. It scans various inputs, including disk images, files, and directories, extracting organized information like email addresses, credit card numbers, JPEG images, and JSON fragments. This is achieved without the need to parse file systems or their structures. The extracted data is saved in text files, which can be examined, searched, or utilized as inputs for further forensic investigations.

NetworkMiner

NetworkMiner, an open-source network forensics tool, specializes in extracting artifacts like files, images, emails, and passwords from network traffic captured in PCAP files. Additionally, it can capture live network traffic by sniffing a network interface.

Velociraptor

Velociraptor is a sophisticated digital forensics and incident response tool designed to improve your insight into endpoint activities. At the press of a (few) buttons, perform targeted collection of digital forensic evidence simultaneously across your endpoints, with speed and precision.

digital forensics tools

WinHex

WinHex is a versatile hexadecimal editor, proving especially useful in the areas of computer forensics, data recovery, low-level data processing, and IT security. It allows users to inspect and modify various file types, as well as recover deleted files or retrieve lost data from hard drives with damaged file systems or digital camera cards.

SABRENT USB 3.0 to SATA External Hard Drive Lay-Flat Docking Station | for 2.5 or 3.5in HDD, SSD

Learn Computer Forensics: Your one-stop guide to searching, analyzing, acquiring, and securing digital evidence

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory

Tags: Forensics Tools

Feb 03 2023

Most Important Computer Forensics Tools for 2023

Category: Security Tools — DISC @ 5:10 pm
Most Important Computer Forensics Tools for 2023

Computer Forensics tools are more often used by security industries to test the vulnerabilities in networks and applications by collecting the evidence to find an indicator of compromise and take appropriate mitigation Steps.

Here you can find the Comprehensive Computer Forensics tools list that covers Performing Forensics analysis and responding to incidents in all Environments.

Digitial Forensics analysis includes preservation, collection, Validation, Identification, Analysis, Interpretation, Documentation, and Presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal.

Collections of Computer Forensics Tools

Computer Forensics Tools

Free Digital Forensic Tools

Distributions – Open Source Forensic Tools

Frameworks

  • dff – Forensic framework
  • IntelMQ – IntelMQ collects and processes security feeds
  • Laika BOSS – Laika is an object scanner and intrusion detection system
  • PowerForensics – PowerForensics is a framework for live disk forensic analysis
  • The Sleuth Kit – Tools for low level forensic analysis
  • turbinia – Turbinia is an open-source framework for deploying, managing, and running forensic workloads on cloud platforms

Live Network Forensics Tools

  • grr – GRR Rapid Response: remote live forensics for incident response
  • Linux Expl0rer – Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask
  • mig – Distributed & real time digital forensics at the speed of the cloud
  • osquery – SQL powered operating system analytics

Imaging

  • dc3dd – Improved version of dd
  • dcfldd – Different improved version of dd (this version has some bugs!, another version is on github adulau/dcfldd)
  • FTK Imager – Free imageing tool for windows
  • Guymager – Open source version for disk imageing on linux systems

Carving

  • bstrings – Improved strings utility
  • bulk_extractor – Extracts informations like email adresses, creditscard numbers and histrograms of disk images
  • floss – Static analysis tool to automatically deobfuscate strings from malware binaries
  • photorec – File carving tool

Memory Forensics Tools

  • inVtero.net – High speed memory analysis framework developed in .NET supports all Windows x64, includes code integrity and write support.
  • KeeFarce – Extract KeePass passwords from memory
  • Rekall – Memory Forensic Framework
  • volatility – The memory forensic framework
  • VolUtility – Web App for Volatility framework
  • BlackLight – Windows/MacOS Computer Forensics tools client supporting hiberfil, pagefile, raw memory analysis.
  • DAMM – Differential Analysis of Malware in Memory, built on Volatility.
  • evolve – Web interface for the Volatility Memory Forensics Framework.
  • FindAES – Find AES encryption keys in memory.
  • inVtero.net – High speed memory analysis framework developed in .NET supports all Windows x64, includes code integrity and write support.
  • Muninn – A script to automate portions of analysis using Volatility, and create a readable report.
  • Rekall – Memory analysis framework, forked from Volatility in 2013.
  • TotalRecall – Script based on Volatility for automating various malware analysis tasks.
  • VolDiff – Run Volatility on memory images before and after malware execution, and report changes.
  • Volatility – Advanced memory forensics framework.
  • VolUtility – Web Interface for Volatility Memory Analysis framework.
  • WDBGARK – WinDBG Anti-RootKit Extension.
  • WinDbg – Live memory inspection and kernel debugging for Windows systems.

Network Forensics Tools

  • SiLK Tools – SiLK is a suite of network traffic collection and Computer Forensics tools analysis tools
  • Wireshark – The network traffic analysis tool
  • NetLytics – Analytics platform to process network data on Spark.

Windows Artifacts

OS X Forensics

Internet Artifacts

  • chrome-url-dumper – Dump all locally stored information collected by Chrome
  • hindsight – Internet history forensics for Google Chrome/Chromium

Timeline Analysis

  • DFTimewolf – Framework for orchestrating Computer Forensics tools collection, processing, and data export using GRR and Rekall
  • plaso – Extract timestamps from various files and aggregate them
  • timesketch – Collaborative forensic timeline analysis

Disk Image Handling

  • aff4 – AFF4 is an alternative, fast file format
  • imagemounter – Command line utility and Python package to ease the (un)mounting of forensic disk images
  • libewf – Libewf is a library and some tools to access the Expert Witness Compression Format (EWF, E01)
  • xmount – Convert between different disk image formats

Decryption

Learn Forensics

Forensic CTFs Tools

There are many relatively new tools available that have been developed in order to recover and dissect the information.

Tags: Forensics Tools