Standalone Tool

Showing 1 to 50 of 114 results

New

SECFORE Extractor

DFIR Tools

Secfore Extractor is a mobile forensic acquisition tool for Android and iOS devices. Supports logical, file system, and targeted application data extr...

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: SECFORE

Featured

F-Response TACTICAL

DFIR Tools

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: F-Response

Featured

F-Response Consultant

DFIR Tools

Primary Use Case: Cloud / Remote Acquisition
Tool Type: Standalone Tool
Developer: F-Response

Featured

F-Response Consultant + Covert

DFIR Tools

Primary Use Case: Cloud / Remote Acquisition
Tool Type: Standalone Tool
Developer: F-Response

Featured

F-Response Enterprise

DFIR Tools

Primary Use Case: Cloud / Remote Acquisition
Tool Type: Standalone Tool
Developer: F-Response

Featured

F-Response Collect

DFIR Tools

Primary Use Case: Cloud / Remote Acquisition
Tool Type: Standalone Tool
Developer: F-Response

DNS Tools

DFIR Tools

Primary Use Case: Network / Packet Analysis
Tool Type: Standalone Tool

Genesis

DFIR Tools

Primary Use Case: eDiscovery / Review
Tool Type: Standalone Tool
Developer: Cellebrite

REMnux

DFIR Tools

Primary Use Case: Malware Analysis
Tool Type: Standalone Tool
Developer: REMnux

Featured

Binalyze Standalone Collectors

DFIR Tools

Lightweight forensic acquisition tools for targeted evidence collection from supported endpoints and infrastructure without deploying the full Binalyz...

Primary Use Case: Tool Collection
Tool Type: Standalone Tool
Developer: Binalyze

EVTX Parser

DFIR Tools

EVTX parser is an online EVTX viewer and Windows Event Log parser. Open a .evtx file — Security.evtx, System.evtx, Application.evtx, Sysmon or PowerSh...

Primary Use Case: Artifact Parsing / Extraction
Tool Type: Standalone Tool

Registry Parser

DFIR Tools

Registry Parser is a free, browser-based forensic tool for analyzing Windows Registry hives.

Primary Use Case: Artifact Parsing / Extraction
Tool Type: Standalone Tool
Developer: Fakgroup

Crush Forenics

DFIR Tools

Open and navigate ZIP and TAR archives, folders, and individual files without extracting anything to disk first.

Primary Use Case: Artifact Parsing / Extraction
Tool Type: Standalone Tool

Lava

DFIR Tools

LAVA is the LEAPP Artifact Viewer App, built to help examiners review, visualize, and correlate parsed output from ALEAPP, iLEAPP, RLEAPP, and VLEAPP...

Primary Use Case: Timeline Analysis
Tool Type: Standalone Tool
Developer: Alexis Brignoni

bulk_extractor

DFIR Tools

bulk_extractor is a high-speed digital forensic feature extraction tool that scans disk images, files, and directories for useful artifacts without re...

Primary Use Case: Artifact Parsing / Extraction
Tool Type: Standalone Tool
Developer: Simson Garfinkel

VFC Mount

DFIR Tools

VFC Mount is a free forensic image mounting tool from MD5 LTD. It mounts a forensic disk image as an emulated physical disk so the image can be examin...

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: MD5

VFC Portable

DFIR Tools

VFC Portable is the field-use version of VFC. MD5 describes it as having the same functionality as VFC Lab, with added features for use in the field....

Primary Use Case: Triage / Rapid Assessment
Tool Type: Standalone Tool
Developer: MD5

VFC Lab

DFIR Tools

VFC Lab is a forensic virtualization tool from MD5 LTD that allows investigators to create and examine a virtual machine from a forensic image or writ...

Primary Use Case: Triage / Rapid Assessment
Tool Type: Standalone Tool
Developer: MD5

VFC — Virtual Forensic Computing

DFIR Tools

VFC, or Virtual Forensic Computing, is a forensic virtualization tool from MD5 LTD that allows investigators to view and interact with a suspect compu...

Primary Use Case: Triage / Rapid Assessment
Tool Type: Standalone Tool
Developer: MD5

ArtiFast Lite

DFIR Tools

ArtiFast Lite is the free viewer/light version of ArtiFast for reviewing cases processed by other ArtiFast versions and parsing a limited subset of W...

Primary Use Case: Artifact Parsing / Extraction
Tool Type: Standalone Tool
Developer: Forensafe Software Solutions

RECON ITR

DFIR Tools

RECON ITR is SUMURI’s macOS imaging and triage tool for live, bootable, and logical acquisition from modern Apple systems.

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: Sumuri

Monolith Notes

DFIR Tools

Monolith Notes is a free investigation note-taking app that stores notes locally and exports them to PDF.

Primary Use Case: Reporting / Case Management
Tool Type: Standalone Tool
Developer: Monolith Forensics

ProDiscover First Responder

DFIR Tools

ProDiscover First Responder is a field evidence collection tool for documenting evidence, preserving chain of custody, following SOP checklists, and s...

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: ProDiscover

ProDiscover Triage

DFIR Tools

ProDiscover Triage is a rapid forensic triage tool for live system analysis, evidence prioritization, partial imaging, timeline support, and quick rep...

Primary Use Case: Triage / Rapid Assessment
Tool Type: Standalone Tool
Developer: ProDiscover

ArtEx - Artifact Examiner

DFIR Tools

ArtEx is a free mobile forensic artifact review, validation, reporting, and research tool for working with common mobile extraction types and selected...

Primary Use Case: Mobile Device Forensics
Tool Type: Standalone Tool
Developer: DoubleBlak

Passware Kit Mobile

DFIR Tools

Passware Kit Mobile is a mobile forensic decryption tool for extracting and decrypting data from supported locked, encrypted, or disabled Android and...

Primary Use Case: Mobile Device Forensics
Tool Type: Standalone Tool
Developer: Passware

Fuji

DFIR Tools

Fuji is a free, open-source macOS forensic acquisition tool designed to perform live logical acquisition of Mac computers, including modern Intel and...

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool

Featured

F-Response Universal

DFIR Tools

Primary Use Case: Cloud / Remote Acquisition
Tool Type: Standalone Tool
Developer: F-Response

LUMYX

DFIR Tools

LUMYX is a browser-based platform for importing, analyzing, visualizing, and presenting location-based evidence in criminal and civil cases.

Primary Use Case: Geolocation
Tool Type: Standalone Tool
Developer: Lumyx

StaticFuzz

DFIR Tools

StaticFuzz is a forensic GPS analysis tool. It takes any lat/lng/timestamp CSV from mobile forensics exports, carrier records, or telematics and runs...

Primary Use Case: Geolocation
Tool Type: Standalone Tool
Developer: StaticFuzz

E3:View

DFIR Tools

E3:View is Paraben’s read-only evidence review tool for allowing attorneys, managers, investigators, or other team members to review and report on ca...

Primary Use Case: eDiscovery / Review
Tool Type: Standalone Tool
Developer: Paraben Corporation

Forensic Notes

DFIR Tools

Forensic Notes is a court-focused digital notetaking and investigation documentation platform for creating timestamped, hashed, digitally signed note...

Primary Use Case: Reporting / Case Management
Tool Type: Standalone Tool
Developer: Forensic Notes

FTK Imager Pro

DFIR Tools

Exterro FTK Imager Pro extends FTK Imager with paid professional features for rapid preview, targeted collection, iOS logical acquisition, decryption...

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: exterro

FTK Imager

DFIR Tools

Exterro FTK Imager is a free forensic imaging and preview tool used to acquire disk images, capture RAM, preview files, verify hashes, and preserve e...

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: exterro

Nuix Enterprise Collection Center

DFIR Tools

Remote and enterprise collection product for automating targeted data collection from endpoints, file shares, and other connected or remote sources.

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: Nuix

Nuix Investigate

DFIR Tools

Visual analytics and case review tool for quickly seeing communication patterns, establishing case position, and improving investigative decision-mak...

Primary Use Case: Reporting / Case Management
Tool Type: Standalone Tool
Developer: Nuix

Cellebrite Physical Analyzer

DFIR Tools

Mobile forensic analysis tool focused on decoding app data, reconstructing activity, and examining evidence, with vendor claims of support for 40,000...

Primary Use Case: Mobile Device Forensics
Tool Type: Standalone Tool
Developer: Cellebrite

Cellebrite UFED

DFIR Tools

Mobile extraction tool focused on lawful, forensically sound collection from feature phones, smartphones, drones, SIM cards, SD cards, GPS devices, a...

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: Cellebrite

FEX Imager

DFIR Tools

A free forensic imaging tool that acquires or hashes bit-level forensic images with MD5, SHA1, and SHA256 authentication. It supports acquisition of...

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: GetData Forensics

Mount Image Pro

DFIR Tools

A forensic image mounting tool that mounts image files as a Windows drive letter so investigators can browse contents, run third-party tools, and exp...

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: GetData Forensics

Amped DVRConv

DFIR Tools

Batch conversion tool for turning proprietary CCTV, DVR, dashcam, and body-worn camera video into playable, forensically documented output.

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: Amped Software

Amped Replay

DFIR Tools

Investigator-focused video player for quick first-level review, correction, annotation, redaction, and basic evidentiary preparation across CCTV and...

Primary Use Case: Multimedia / Audio / Video
Tool Type: Standalone Tool
Developer: Amped Software

Berla iVe Mobile

DFIR Tools

Mobile companion app for identifying supported vehicles and installed systems, showing what data can be retrieved, and guiding investigators before a...

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: Berla

OSForensics Bootable USB

DFIR Tools

A bootable WinPE-based version of OSForensics that lets an examiner run the full suite from a USB drive in a known clean environment for offline tria...

Primary Use Case: Bootable Operating System
Tool Type: Standalone Tool
Developer: PassMark Software

ImageUSB

DFIR Tools

A free utility for concurrent bit-level USB imaging and duplication, including ISO writing, drive zeroing, and removable-media preparation.

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: PassMark Software

OSFClone

DFIR Tools

A free self-booting imaging tool for creating exact forensic disk images and clones in raw, AFF, EWF, and dc3dd-compatible formats with hash verificat...

Primary Use Case: Bootable Operating System
Tool Type: Standalone Tool
Developer: OSForensics

OSFMount

DFIR Tools

A free utility that mounts local disk image files in Windows as physical disks or drive letters, with read-only and write-cache options for safe anal...

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: OSForensics

Featured

Binalyze Tornado

DFIR Tools

A free standalone desktop collector for BEC investigations that pulls cloud evidence from Microsoft 365 and Google Workspace, including email, logs,...

Primary Use Case: Cloud / Remote Acquisition
Tool Type: Standalone Tool
Developer: Binalyze

LLIMAGER

DFIR Tools

LIMAGER meets the need for robust and comprehensive forensic imaging of Mac computers by performing Full File System acquisitions.

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: e-Forensics

XRY Express

DFIR Tools

Simplified extraction software for Windows that gives frontline users a controlled, easy-to-follow workflow for mobile device acquisition.

Primary Use Case: Collection / Acquisition
Tool Type: Standalone Tool
Developer: MSAB