Your Lab Is Ready: Free Evidence Samples + Free Software to Work Practice Cases.
Yesterday’s release of the free forensic test images and CTFs took off fast. Downloads, shares, and discussions across social media haven’t slowed down. Over 38,000 views in just 2 days. Goodness.
That tells me something important: practitioners don’t just want datasets to play with; they want real data to practice on and tools to make sense of it.
TERABYTES OF FORENSIC TEST IMAGES
HUNDREDS OF CTFs
https://t.co/dsUPfRNMxH #DFIR #CTF pic.twitter.com/Su4YFzbWAf
— DFIR Training (@DFIRTraining) October 23, 2025
So let’s talk about the next step. You have access to a universe of data, but now what? How to access it? For tools you don’t have, there are free and free-for-a-time-limit tools you can use.
Below is a set of industry-proven forensic tools, that you can use right now to analyze the test images you can download. Whether you’re learning, teaching, validating workflows, or comparing tool results, this list gives you everything you need to turn that test data into practice.
Test data is only half the equation.
You can stare at raw disk images or mobile dumps all day, but without analysis tools, it’s like trying to decode DNA with a magnifying glass. What makes a competent examiner isn’t just access to tools, it’s understanding how to use them critically, how to compare output between suites, and how to question what’s missing. That’s what these tools help you do.
Plus, you can compare your tools against these for free (you gotta pay with your time. i can't do anything about that...).
Tools You Can Use Right Now
Below are seven widely used tools in DFIR, with links to their trial or download options when available. Each tool pairs perfectly with the free test images you grabbed yesterday.
Type: Comprehensive forensic suite (computer, mobile, cloud, memory)
Trial: Free trial available
Get it: belkasoft.com/trial
Use it for: Disk and mobile acquisitions, timeline analysis, and memory forensics on your test images. Belkasoft is one of the most flexible all-in-one tools out there and supports over 1,000 artifact types. It’s fast, visual, and perfect for validation work. They have free tools as well, like Belkasoft T (triage), and Belkasoft Live RAM Capturer.
🟢 Belkasoft is also one of our site sponsors; thanks to them for supporting the DFIR community.
Type: Rapid triage and automated collection tools
Trial: Free evaluation version available
Get it: https://www.adfsolutions.com/free-trial
Use it for: Running quick scans on your test images to identify artifacts before deep dives. ADF’s tools (Triage-G2, Digital Evidence Investigator, etc.) are built for front-line responders and investigators who need quick insight on live or static media.
🟢 ADF is also a DFIR.Training sponsor, they’re committed to helping examiners get started fast.
Type: Full forensic suite for computer, mobile, and cloud evidence
Trial: ⚙️ Evaluation available upon request (not an instant public download)
Get it: https://www.magnetforensics.com/products/magnet-axiom/
Use it for: Parsing large datasets and comparing tool performance with Belkasoft and ADF outputs. Magnet’s AXIOM and other tools are staples in modern forensic workflows excellent for cross-validation of your test image results. Magnet offers a good handful of free tools as well.
🟢 Magnet Forensics is also a DFIR.Training sponsor, they’re committed to helping examiners close cases fast and accurate.
Type: Specialist artifact tools for registry and Windows evidence
Trial: ⚙️ Demos / free utilities available
Get it: https://arsenalrecon.com/downloads
Use it for: Deep-dive analysis of registry hives, Windows artifacts, and email or PST data from your test sets. Arsenal tools (Registry Recon, Hibernation Recon, etc.) are forensic staples for when you need granular insight into system-level artifacts.
Type: Incident response and triage analysis
Trial: ⚙️ Free trial available upon request
Get it: https://www.cybertriage.com/
Use it for: Rapid triage and incident response workflows; ideal for IR-style validation using your test data. Cyber Triage bridges the gap between automated IR collection and full forensic examination, a strong fit for real-world scenarios. Want a full forensic suite for free? They also provide Autopsy Digital Forensics for free: https://www.autopsy.com/
🟢 Cyber Triage is also a DFIR.Training sponsor, they’re one of the top innovators in the field, particularly around the investigation aspect!
Type: Case documentation and chain of custody platform
Trial: ⚙️ Free plan or demo available upon request
Get it: https://www.forensicnotes.com/
Use it for: Maintaining defensible documentation as you process the test images, perfect for students or teams testing workflow compliance. This tool doesn’t analyze data but keeps your notes, chain of custody, and reports compliant with evidentiary standards.
Type: Advanced forensic suite and automation extensions
Trial: ⚙️ Available upon request (law enforcement / commercial)
Get it: https://www.apiforensics.com/download.asp
Use it for: High-performance disk analysis, hash set validation, and cross-checking recovered data via X-Ways API addons. API Forensics offers a growing collection of X-Ways add-ons, including automation scripts and integrations, perfect for extending your lab capabilities.
Type: Forensic suites
Trial: ⚙️ Available upon request
Get it: https://www.nuix.com/request-a-demo
Use it for: Investigative analytics, intelligence, and legal software solutions.
More free software!
The DFIR Training tool database has even more free forensic tools to check out.
How to Use This List
Here’s how to get the most out of these tools with your free DFIR test images:
1. Pick one dataset from yesterday’s release but don’t try to analyze all of them at once.
2. Select two or three tools from the list above that align with your focus (triage, deep analysis, artifact testing, reporting).
3. Document your workflow using Forensic Notes or your own documentation templates.
4. Compare output across tools with what one tool recovers as another may miss or interpret differently.
5. Post your findings and share your screenshots, discoveries, or questions in DFIR forums or LinkedIn discussions.
By doing this, you’ll start to build your own internal reference for how tools differ and where they align the foundation of real forensic judgment.
Explore the Full DFIR Tools Database
This list is just a starting point. The DFIR Tools Database on DFIR.Training features hundreds of tools, categorized by function, platform, and artifact type; all searchable and linked to their developers. Visit the full, but growing, tool database here: DFIR Tools Library
Final Thoughts
Yesterday you downloaded the data. Today you have the tools to process it. Now it’s on you to start connecting the dots, testing, breaking, validating, and documenting your findings. That’s how professionals get better: Not just by learning tools, but by learning how tools think.
If you find something interesting using these tools and test images, tag me @brett_shavers or @DFIRTraining on X or LinkedIn. I’d like to share your results with the community.
– Brett Shavers
DFIR.Training / Placing the Suspect Behind the Keyboard®