Triage / Rapid Assessment

Showing 1 to 50 of 67 results

bulk_extractor

bulk_extractor

DFIR Tools
bulk_extractor is a high-speed digital forensic feature extraction tool that scans disk images, files, and directories for useful artifacts without re...
Primary Use Case
Artifact Parsing / Extraction
Tool Type
Standalone Tool
Developer
Simson Garfinkel
VFC Mount

VFC Mount

DFIR Tools
VFC Mount is a free forensic image mounting tool from MD5 LTD. It mounts a forensic disk image as an emulated physical disk so the image can be examin...
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
MD5
Atola Insight Forensic

Atola Insight Forensic

DFIR Tools
 Atola Insight Forensic is a forensic imager and data recovery system for acquiring difficult or damaged storage media, diagnosing drive health, remov...
Primary Use Case
Write blocker
Tool Type
Hardware
Developer
Atola
Atola TaskForce

Atola TaskForce

DFIR Tools
 Atola TaskForce is a high-performance forensic imager for parallel acquisition, RAID reassembly, damaged media handling, remote acquisition, and brow...
Primary Use Case
Write blocker
Tool Type
Hardware
Developer
Atola
Atola TaskForce 2

Atola TaskForce 2

DFIR Tools
 Atola TaskForce 2 is a high-capacity forensic imaging system for labs that need to image many drives in parallel, handle damaged media, reassemble RA...
Primary Use Case
Write blocker
Tool Type
Hardware
Developer
Atola
PALADIN Forensic Suite

PALADIN Forensic Suite

DFIR Tools
SUMURI describes PALADIN as a live USB Linux distribution based on Ubuntu, with the PALADIN Toolbox, built-in write blocking, Autopsy/Sleuth Kit, imag...
Primary Use Case
Bootable Operating System
Tool Type
Suite
Developer
Sumuri
RECON ITR

RECON ITR

DFIR Tools
RECON ITR is SUMURI’s macOS imaging and triage tool for live, bootable, and logical acquisition from modern Apple systems. 
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
Sumuri
ProDiscover Pro

ProDiscover Pro

DFIR Tools
 ProDiscover Pro is a digital forensic suite for capturing, preserving, analyzing, and reporting digital evidence, including disk imaging, hidden/dele...
Primary Use Case
Suite / Full Examination
Tool Type
Suite
Developer
ProDiscover
Exterro Intelligence

Exterro Intelligence

DFIR Tools
Exterro Intelligence is Exterro’s AI layer for summarization, classification, image and video recognition, artifact prioritization, translation, trans...
Primary Use Case
Artifact Parsing / Extraction
Tool Type
Platform / Service
Developer
exterro
Exterro Smart Breach Review

Exterro Smart Breach Review

DFIR Tools
 Exterro Smart Breach Review helps organizations review compromised data, identify sensitive information, associate exposed data with affected individ...
Primary Use Case
eDiscovery / Review
Tool Type
Platform / Service
Developer
exterro
FTK Enterprise

FTK Enterprise

DFIR Tools
 Exterro FTK Enterprise is a remote endpoint collection and investigation platform for acquiring targeted forensic evidence from distributed endpoints...
Primary Use Case
Cloud / Remote Acquisition
Tool Type
Platform / Service
Developer
exterro
FTK Imager Pro

FTK Imager Pro

DFIR Tools
 Exterro FTK Imager Pro extends FTK Imager with paid professional features for rapid preview, targeted collection, iOS logical acquisition, decryption...
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
exterro
Chainalysis Data Solutions

Chainalysis Data Solutions

DFIR Tools
Chainalysis Data Solutions provides blockchain intelligence, monitoring, alerting, address enrichment, and custom analytics for large-scale cryptocurr...
Primary Use Case
OSINT / Web Investigation
Tool Type
Platform / Service
Developer
Chainalysis
OpenText Endpoint Forensics & Response

OpenText Endpoint Forensics & Response

DFIR Tools
Enterprise DFIR platform focused on rapid endpoint triage and response at scale, including artifact-driven workflows, YARA/IoC scanning, isolation, re...
Primary Use Case
Triage / Rapid Assessment
Tool Type
Platform / Service
Developer
OpenText
FEX Imager

FEX Imager

DFIR Tools
 A free forensic imaging tool that acquires or hashes bit-level forensic images with MD5, SHA1, and SHA256 authentication. It supports acquisition of...
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
GetData Forensics
Mount Image Pro

Mount Image Pro

DFIR Tools
 A forensic image mounting tool that mounts image files as a Windows drive letter so investigators can browse contents, run third-party tools, and exp...
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
GetData Forensics
Forensic Explorer (FEX)

Forensic Explorer (FEX)

DFIR Tools
 A full computer forensics suite for physical disks and forensic images, built around file system analysis, keyword and index search, data recovery, s...
Primary Use Case
Suite / Full Examination
Tool Type
Suite
Developer
GetData Forensics
Berla iVe Toolkit

Berla iVe Toolkit

DFIR Tools
 Hardware acquisition kit with the boards, cables, and removal tools needed to collect data from supported vehicle systems in place or after removal. 
Primary Use Case
Collection / Acquisition
Tool Type
Hardware
Developer
Berla
Berla iVe Mobile

Berla iVe Mobile

DFIR Tools
 Mobile companion app for identifying supported vehicles and installed systems, showing what data can be retrieved, and guiding investigators before a...
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
Berla
Rainbow Table & Hash Set Collection

Rainbow Table & Hash Set Collection

DFIR Tools
A paid 4TB NVMe hardware collection of rainbow tables and hash sets intended to accelerate password recovery and hash-based file identification workfl...
Primary Use Case
Password / Decryption
Tool Type
Hardware
Developer
PassMark Software
OSFMount

OSFMount

DFIR Tools
 A free utility that mounts local disk image files in Windows as physical disks or drive letters, with read-only and write-cache options for safe anal...
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
OSForensics
Magellan
Featured

Magellan

DFIR Tools
 An AIR-embedded investigative eDiscovery capability that runs full-text content searches at the endpoint to expose what is actually inside files for...
Primary Use Case
eDiscovery / Review
Tool Type
Platform / Service
Developer
Binalyze
Binalyze Tornado
Featured

Binalyze Tornado

DFIR Tools
 A free standalone desktop collector for BEC investigations that pulls cloud evidence from Microsoft 365 and Google Workspace, including email, logs,...
Primary Use Case
Cloud / Remote Acquisition
Tool Type
Standalone Tool
Developer
Binalyze
Binalyze AIR
Featured

Binalyze AIR

DFIR Tools
 An automated DFIR platform for remote collection, compromise assessment, triage, timelines, and collaborative investigations across large estates. 
Primary Use Case
Suite / Full Examination
Tool Type
Platform / Service
Developer
Binalyze
XRY Express

XRY Express

DFIR Tools
 Simplified extraction software for Windows that gives frontline users a controlled, easy-to-follow workflow for mobile device acquisition. 
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
MSAB
XRY Tablet

XRY Tablet

DFIR Tools
 Portable tablet-based extraction platform for on-scene recovery when investigators need a guided mobile workflow away from the lab. 
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
MSAB
XRY Kiosk

XRY Kiosk

DFIR Tools
 Turnkey kiosk workstation for fast, standardized mobile extractions by frontline or non-expert users. 
Primary Use Case
Collection / Acquisition
Tool Type
Hardware
Developer
MSAB
XRY Pro Express

XRY Pro Express

DFIR Tools
 Frontline extraction product that combines advanced access methods with a simplified workflow for locked and encrypted devices. 
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
MSAB
XRY Logical

XRY Logical

DFIR Tools
 Entry-level mobile extraction tool designed for fast logical and file-system recovery, including field use. 
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
MSAB
Techno Data Kit

Techno Data Kit

DFIR Tools
 Techno Data Kit is a DATAPILOT add-on for acquiring evidence from removable and external media such as SD cards, USB drives, portable hard drives, an...
Primary Use Case
Collection / Acquisition
Tool Type
Script / Utility / Addon
Developer
DATAPILOT
DATAPILOT DPX

DATAPILOT DPX

DFIR Tools
DATAPILOT DPX is a rugged Windows-based field-and-lab acquisition device focused on faster evidence collection from a wide range of mobile and digital...
Primary Use Case
Collection / Acquisition
Tool Type
Hardware
Developer
DATAPILOT
DATAPILOT DP10

DATAPILOT DP10

DFIR Tools
DATAPILOT DP10 is a rugged mobile forensic field device built to triage, acquire, search, and report evidence from phones, tablets, watches, and relat...
Primary Use Case
Mobile Device Forensics
Tool Type
Hardware
Developer
DATAPILOT
HardCopy 3P

HardCopy 3P

DFIR Tools
 A stand-alone forensic imaging and cloning device for SATA and IDE drives that performs hardware write-blocked acquisition with built-in hashing and...
Primary Use Case
Collection / Acquisition
Tool Type
Hardware
Developer
Voom
Truxton Enterprise Server/Client Deployment

Truxton Enterprise Server/Client Deployment

DFIR Tools
 This Truxton Enterprise deployment model uses a central server with client users and configurable parallel media loaders to support collaborative rev...
Primary Use Case
Reporting / Case Management
Tool Type
Platform / Service
Developer
Truxton
Truxton Multi-User Edition

Truxton Multi-User Edition

DFIR Tools
 Truxton Multi-User Edition is a shared analytical platform for up to 10 investigators to collaborate on rapid review, shared findings, reports, and a...
Primary Use Case
Reporting / Case Management
Tool Type
Standalone Tool
Developer
Truxton
Truxton LE: Single User Edition

Truxton LE: Single User Edition

DFIR Tools
Truxton LE is a single-user edition that automatically identifies, correlates, and reports key artifacts from phones, hard drives, drones, and other d...
Primary Use Case
Artifact Parsing / Extraction
Tool Type
Standalone Tool
Developer
Truxton
Truxton CE: Community Edition

Truxton CE: Community Edition

DFIR Tools
Truxton CE is a free community edition designed for quick artifact identification, correlation, and summary reporting for smaller organizations, inves...
Primary Use Case
Artifact Parsing / Extraction
Tool Type
Standalone Tool
Developer
Truxton
Volexity Surge

Volexity Surge

DFIR Tools
 Volexity Surge Collect is a cross-platform memory acquisition tool designed to collect reliable, verifiable volatile data from Windows, Linux, and ma...
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
Volexity
Volcano

Volcano

DFIR Tools
Volexity Volcano is a cross-platform memory analysis platform that extracts, indexes, correlates, and visualizes volatile-memory artifacts to support...
Primary Use Case
Memory Analysis
Tool Type
Standalone Tool
Developer
Volexity
X-Ways Imager

X-Ways Imager

DFIR Tools
 A stripped-down X-Ways acquisition tool focused on fast forensic imaging, cloning, hashing, E01/raw image creation, and physical RAID reconstruction....
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
X-Ways
X-Ways Forensics

X-Ways Forensics

DFIR Tools
 A lightweight but advanced computer forensics suite for imaging, file system analysis, artifact review, carving, keyword searching, reporting, and ti...
Primary Use Case
Suite / Full Examination
Tool Type
Suite
Developer
X-Ways
Intella Pro

Intella Pro

DFIR Tools
 Desktop investigation and eDiscovery platform for processing, searching, analyzing, and exporting large volumes of ESI with visual analytics, AI-assi...
Primary Use Case
Reporting / Case Management
Tool Type
Suite
Developer
Vound
ALEAPP

ALEAPP

DFIR Tools
 Free open-source parser for Android full-system extractions that turns logs, events, and protobuf-based artifacts into reviewable reports. 
Primary Use Case
Artifact Parsing / Extraction
Tool Type
Script / Utility / Addon
Developer
Alexis Brignoni
iLEAPP

iLEAPP

DFIR Tools
 Free open-source parser for iOS and iPadOS full file system and backup extractions that converts logs, events, and plist-based artifacts into reviewa...
Primary Use Case
Artifact Parsing / Extraction
Tool Type
Script / Utility / Addon
Developer
Alexis Brignoni
Hibernation Recon

Hibernation Recon

DFIR Tools
 Hibernation Recon is Arsenal Recon’s specialized platform for reconstructing active memory and extracting additional evidence from Windows hibernatio...
Primary Use Case
Memory Analysis
Tool Type
Suite
Developer
Arsenal Recon
Arsenal Image Mounter

Arsenal Image Mounter

DFIR Tools
 Arsenal Image Mounter is Arsenal Recon’s flagship disk-image mounting and VM-launch platform for DFIR work. It has a genuinely useful Free Mode, but...
Primary Use Case
Suite / Full Examination
Tool Type
Suite
Developer
Arsenal Recon
Autopsy Video Triage

Autopsy Video Triage

DFIR Tools
 The Autopsy Video Triage module is an add-on for Autopsy that breaks video files into easily viewable thumbnail keyframes so investigators can quickl...
Primary Use Case
Multimedia / Audio / Video
Tool Type
Script / Utility / Addon
Developer
Sleuth Kit Labs
Law Enforcement Bundle for Autopsy

Law Enforcement Bundle for Autopsy

DFIR Tools
 The Autopsy Law Enforcement Bundle is an add-on module package for Autopsy that helps accelerate CSAM investigations by automatically identifying and...
Primary Use Case
Multimedia / Audio / Video
Tool Type
Script / Utility / Addon
Developer
Sleuth Kit Labs
Autopsy

Autopsy

DFIR Tools
 Autopsy is a free, open-source forensic suite from Sleuth Kit Labs for full examination of disk images and other digital media, with strong core supp...
Primary Use Case
Suite / Full Examination
Tool Type
Suite
Developer
Sleuth Kit Labs
Magnet Shield

Magnet Shield

DFIR Tools
 Magnet Shield is a free Magnet Forensics standalone field-collection tool for capturing consent-based digital evidence from victims and witnesses and...
Primary Use Case
Collection / Acquisition
Tool Type
Standalone Tool
Developer
Magnet Forensics

Main Menu