Collection / Acquisition

Showing 1 to 50 of 73 results

F-Response Consultant
Featured

F-Response Consultant

DFIR Tools
Primary Use Case
Cloud / Remote Acquisition
Tool Type
Standalone Tool
Developer
F-Response
F-Response Consultant + Covert
Featured

F-Response Consultant + Covert

DFIR Tools
Primary Use Case
Cloud / Remote Acquisition
Tool Type
Standalone Tool
Developer
F-Response
F-Response Enterprise
Featured

F-Response Enterprise

DFIR Tools
Primary Use Case
Cloud / Remote Acquisition
Tool Type
Standalone Tool
Developer
F-Response
F-Response Collect
Featured

F-Response Collect

DFIR Tools
Primary Use Case
Cloud / Remote Acquisition
Tool Type
Standalone Tool
Developer
F-Response
Binalyze Standalone Collectors
Featured

Binalyze Standalone Collectors

DFIR Tools
Lightweight forensic acquisition tools for targeted evidence collection from supported endpoints and infrastructure without deploying the full Binalyz...
Primary Use Case
Tool Collection
Tool Type
Standalone Tool
Developer
Binalyze
Guardonix

Guardonix

DFIR Tools
Guardonix is a USB 3.0 forensic write blocker and acquisition stabilizer designed for imaging USB storage devices, degraded drives, and fast flash med...
Primary Use Case
Write blocker
Tool Type
Hardware
Developer
DeepSpar
VFC Portable

VFC Portable

DFIR Tools
 VFC Portable is the field-use version of VFC. MD5 describes it as having the same functionality as VFC Lab, with added features for use in the field....
Primary Use Case
Triage / Rapid Assessment
Tool Type
Standalone Tool
Developer
MD5
Vespereye

Vespereye

DFIR Tools
 Vespereye provides radio-frequency and wireless investigation tools for cellular, Wi-Fi, and RF environment analysis. 
Primary Use Case
Network / Packet Analysis
Tool Type
Hardware
Developer
Vespereye
PALADIN Forensic Suite

PALADIN Forensic Suite

DFIR Tools
SUMURI describes PALADIN as a live USB Linux distribution based on Ubuntu, with the PALADIN Toolbox, built-in write blocking, Autopsy/Sleuth Kit, imag...
Primary Use Case
Bootable Operating System
Tool Type
Suite
Developer
Sumuri
Monolith

Monolith

DFIR Tools
Monolith describes itself as a platform for managing cases, evidence, documentation, tasks, files, and reports in one forensic workflow system. 
Primary Use Case
Reporting / Case Management
Tool Type
Platform / Service
Developer
Monolith Forensics
ProDiscover Triage

ProDiscover Triage

DFIR Tools
ProDiscover Triage is a rapid forensic triage tool for live system analysis, evidence prioritization, partial imaging, timeline support, and quick rep...
Primary Use Case
Triage / Rapid Assessment
Tool Type
Standalone Tool
Developer
ProDiscover
ProDiscover Incident Response

ProDiscover Incident Response

DFIR Tools
 ProDiscover Incident Response is a remote investigation and response platform for examining systems, collecting forensic data, reviewing volatile art...
Primary Use Case
Triage / Rapid Assessment
Tool Type
Platform / Service
Developer
ProDiscover
ProDiscover Pro

ProDiscover Pro

DFIR Tools
 ProDiscover Pro is a digital forensic suite for capturing, preserving, analyzing, and reporting digital evidence, including disk imaging, hidden/dele...
Primary Use Case
Suite / Full Examination
Tool Type
Suite
Developer
ProDiscover
USB Stabilizer

USB Stabilizer

DFIR Tools
 USB Stabilizer is a hardware write blocker and read-instability handling device for recovering data from unstable or degraded mass-storage devices. I...
Primary Use Case
Write blocker
Tool Type
Hardware
Developer
DeepSpar
USB Stabilizer 10Gb

USB Stabilizer 10Gb

DFIR Tools
USB Stabilizer 10Gb is DeepSpar’s higher-performance hardware write blocker and read-instability handling device for physically degraded mass-storage...
Primary Use Case
Write blocker
Tool Type
Hardware
Developer
DeepSpar
Cyacomb Examiner Plus

Cyacomb Examiner Plus

DFIR Tools
Cyacomb Examiner Plus is a forensic triage tool for rapidly identifying known illegal and harmful content on computers, drives, removable media, live...
Primary Use Case
Triage / Rapid Assessment
Tool Type
Platform / Service
Developer
Cyacomb
ATRIO MK II

ATRIO MK II

DFIR Tools
ATRIO MK II is a portable digital forensics triage and acquisition platform built for field, lab, law enforcement, government, military, and responder...
Primary Use Case
Triage / Rapid Assessment
Tool Type
Hardware
Developer
ArcPoint Forensics
Forensic Notes – Mobile

Forensic Notes – Mobile

DFIR Tools
 Forensic Notes – Mobile is the mobile field-notetaking version of Forensic Notes, allowing investigators to create notes in the field and add images,...
Primary Use Case
Reporting / Case Management
Tool Type
Platform / Service
Developer
Forensic Notes
Forensic Notes

Forensic Notes

DFIR Tools
 Forensic Notes is a court-focused digital notetaking and investigation documentation platform for creating timestamped, hashed, digitally signed note...
Primary Use Case
Reporting / Case Management
Tool Type
Standalone Tool
Developer
Forensic Notes
Exterro Connectors

Exterro Connectors

DFIR Tools
 Exterro Connectors provide source-level collection and preservation from cloud, SaaS, collaboration, email, endpoint, and business systems for defens...
Primary Use Case
Cloud / Remote Acquisition
Tool Type
Platform / Service
Developer
exterro
Remote Mobile Discovery

Remote Mobile Discovery

DFIR Tools
 Exterro Remote Mobile Discovery is a remote, agentless mobile collection and review platform for collecting targeted mobile evidence from employee de...
Primary Use Case
Mobile Device Forensics
Tool Type
Platform / Service
Developer
exterro
FTK Connect

FTK Connect

DFIR Tools
 Exterro FTK Connect automates forensic workflows by connecting FTK with SIEM, SOAR, ticketing, case-management, and other systems for incident-trigge...
Primary Use Case
Reporting / Case Management
Tool Type
Platform / Service
Developer
exterro
FTK Enterprise

FTK Enterprise

DFIR Tools
 Exterro FTK Enterprise is a remote endpoint collection and investigation platform for acquiring targeted forensic evidence from distributed endpoints...
Primary Use Case
Cloud / Remote Acquisition
Tool Type
Platform / Service
Developer
exterro
FTK Imager

FTK Imager

DFIR Tools
 Exterro FTK Imager is a free forensic imaging and preview tool used to acquire disk images, capture RAM, preview files, verify hashes, and preserve e...
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
exterro
Chainalysis Wallet Scan

Chainalysis Wallet Scan

DFIR Tools
Chainalysis Wallet Scan helps investigators check recovered seed phrases, private keys, and related wallet-access material for balances, historical ac...
Primary Use Case
Triage / Rapid Assessment
Tool Type
Platform / Service
Developer
Chainalysis
Nuix Adaptive Security

Nuix Adaptive Security

DFIR Tools
 Security and insider-risk product that monitors endpoint, machine, and human behavior in real time to detect and investigate threats and compliance i...
Primary Use Case
Triage / Rapid Assessment
Tool Type
Platform / Service
Developer
Nuix
OpenText Mobile Investigator

OpenText Mobile Investigator

DFIR Tools
 Mobile forensics suite for extracting, analyzing, and reporting evidence from phones, tablets, GPS, and IoT devices, with support for more than 36,00...
Primary Use Case
Mobile Device Forensics
Tool Type
Suite
Developer
OpenText
OpenText eDiscovery

OpenText eDiscovery

DFIR Tools
Enterprise eDiscovery platform for collecting, processing, reviewing, analyzing, redacting, and producing legal data at scale, with AI-assisted review...
Primary Use Case
eDiscovery / Review
Tool Type
Platform / Service
Developer
exterro
OpenText Endpoint Forensics & Response

OpenText Endpoint Forensics & Response

DFIR Tools
Enterprise DFIR platform focused on rapid endpoint triage and response at scale, including artifact-driven workflows, YARA/IoC scanning, isolation, re...
Primary Use Case
Triage / Rapid Assessment
Tool Type
Platform / Service
Developer
OpenText
OpenText Forensic

OpenText Forensic

DFIR Tools
Digital forensics suite for acquiring, triaging, analyzing, and reporting evidence from computers, mobile-related sources, storage media, encrypted vo...
Primary Use Case
Suite / Full Examination
Tool Type
Suite
Developer
OpenText
Cellebrite Endpoint Inspector

Cellebrite Endpoint Inspector

DFIR Tools
 Remote collection product for computers, mobile devices, and cloud apps, offered as SaaS or on-premise for organizations that need remote evidence ac...
Primary Use Case
Cloud / Remote Acquisition
Tool Type
Platform / Service
Developer
Cellebrite
Cellebrite Inseyets

Cellebrite Inseyets

DFIR Tools
 All-in-one mobile forensics suite positioned as a purpose-built, all-inclusive platform powered by Premium access and next-generation UFED workflows...
Primary Use Case
Suite / Full Examination
Tool Type
Suite
Developer
Cellebrite
Berla iVe Desktop

Berla iVe Desktop

DFIR Tools
 Windows-based forensic application used for acquisitions and for post-acquisition parsing, deleted-data recovery, raw file-system review, searching,...
Primary Use Case
Suite / Full Examination
Tool Type
Suite
Developer
Berla
Berla iVe Ecosystem

Berla iVe Ecosystem

DFIR Tools
 Paid vehicle-forensics ecosystem that combines vehicle identification, acquisition hardware, and Windows-based forensic software to acquire, parse, a...
Primary Use Case
Suite / Full Examination
Tool Type
Suite
Developer
Berla
OSForensics Bootable USB

OSForensics Bootable USB

DFIR Tools
 A bootable WinPE-based version of OSForensics that lets an examiner run the full suite from a USB drive in a known clean environment for offline tria...
Primary Use Case
Bootable Operating System
Tool Type
Standalone Tool
Developer
PassMark Software
OSFClone

OSFClone

DFIR Tools
A free self-booting imaging tool for creating exact forensic disk images and clones in raw, AFF, EWF, and dc3dd-compatible formats with hash verificat...
Primary Use Case
Bootable Operating System
Tool Type
Standalone Tool
Developer
OSForensics
Fleet AI
Featured

Fleet AI

DFIR Tools
 An AIR-integrated AI investigation assistant that helps analysts generate detection content, interpret findings, triage activity, and recommend next...
Primary Use Case
Triage / Rapid Assessment
Tool Type
Platform / Service
Developer
Binalyze
Binalyze Tornado
Featured

Binalyze Tornado

DFIR Tools
 A free standalone desktop collector for BEC investigations that pulls cloud evidence from Microsoft 365 and Google Workspace, including email, logs,...
Primary Use Case
Cloud / Remote Acquisition
Tool Type
Standalone Tool
Developer
Binalyze
Binalyze AIR
Featured

Binalyze AIR

DFIR Tools
 An automated DFIR platform for remote collection, compromise assessment, triage, timelines, and collaborative investigations across large estates. 
Primary Use Case
Suite / Full Examination
Tool Type
Platform / Service
Developer
Binalyze
XRY Cloud

XRY Cloud

DFIR Tools
 Cloud-focused acquisition tool that recovers data from connected online accounts and cloud services using available device tokens. 
Primary Use Case
Cloud / Remote Acquisition
Tool Type
Standalone Tool
Developer
MSAB
Maresware

Maresware

DFIR Tools
Maresware Tools is a collection of command-line forensic and data-analysis utilities focused on evidence cataloging, file hashing and comparison, fore...
Primary Use Case
Tool Collection
Tool Type
Standalone Tool
Developer
Maresware
DATAPILOT DP10

DATAPILOT DP10

DFIR Tools
DATAPILOT DP10 is a rugged mobile forensic field device built to triage, acquire, search, and report evidence from phones, tablets, watches, and relat...
Primary Use Case
Mobile Device Forensics
Tool Type
Hardware
Developer
DATAPILOT
Elcomsoft Explorer for WhatsApp

Elcomsoft Explorer for WhatsApp

DFIR Tools
WhatsApp-specific acquisition and review tool for Android devices, iOS backups, and cloud-stored WhatsApp data. 
Primary Use Case
Mobile Device Forensics
Tool Type
Standalone Tool
Developer
Elcomsoft
Elcomsoft System Recovery

Elcomsoft System Recovery

DFIR Tools
Bootable Windows-based utility for forensic imaging, offline account access, metadata extraction, and rapid system collection. 
Primary Use Case
Bootable Operating System
Tool Type
Standalone Tool
Developer
Elcomsoft
Elcomsoft Forensic Disk Decryptor |

Elcomsoft Forensic Disk Decryptor |

DFIR Tools
 Disk-decryption utility for mounting and accessing protected volumes using recovered keys, dumps, or known credentials. 
Primary Use Case
Password / Decryption
Tool Type
Standalone Tool
Developer
Elcomsoft
Elcomsoft Cloud eXplorer |

Elcomsoft Cloud eXplorer |

DFIR Tools
 Google-account acquisition tool for pulling and reviewing a wide range of cloud-stored user data. 
Primary Use Case
Cloud / Remote Acquisition
Tool Type
Standalone Tool
Developer
Elcomsoft
Elcomsoft Quick Triage

Elcomsoft Quick Triage

DFIR Tools
 Rapid Windows triage tool for extracting critical evidence early in an investigation from a computer or disk. 
Primary Use Case
Triage / Rapid Assessment
Tool Type
Standalone Tool
Developer
Elcomsoft
Elcomsoft iOS Forensic Toolkit

Elcomsoft iOS Forensic Toolkit

DFIR Tools
 iOS acquisition toolkit for full file system, logical, and supported low-level extraction with keychain and device-secret access. 
Primary Use Case
Mobile Device Forensics
Tool Type
Standalone Tool
Developer
Elcomsoft
Elcomsoft Mobile Forensic Bundle

Elcomsoft Mobile Forensic Bundle

DFIR Tools
 Mobile-focused bundle for physical, logical, and over-the-air acquisition plus backup decryption and review. 
Primary Use Case
Mobile Device Forensics
Tool Type
Suite
Developer
Elcomsoft
Truxton Enterprise Edition

Truxton Enterprise Edition

DFIR Tools
 Truxton Enterprise Edition is a large-scale forensic platform for regional or national organizations that supports automated artifact identification,...
Primary Use Case
Reporting / Case Management
Tool Type
Platform / Service
Developer
Truxton

Main Menu