Saturday, December 2, 2023

Most Important Computer Forensics Tools for 2023

Computer Forensics tools are more often used by security industries to test the vulnerabilities in networks and applications by collecting the evidence to find an indicator of compromise and take appropriate mitigation Steps.

Here you can find the Comprehensive Computer Forensics tools list that covers Performing Forensics analysis and responding to incidents in all Environments.

Digital Forensics analysis includes preservation, collection, Validation, Identification, Analysis, Interpretation, Documentation, and Presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal.

Collections of Computer Forensics Tools

  • DFIR – The definitive compendium project – Collection of forensic resources for learning and research. Offers lists of certifications, books, blogs, challenges, and more
  • – Database of forensic resources focused on events, tools, and more
  • Artifact Repository – Machine-readable knowledge base of forensic artifacts

Free Digital Forensic Tools

  • Forensics tools on Wikipedia
  • Free computer forensic tools – Comprehensive list of free digital forensic tools

DistributionsOpen Source Forensic Tools

  • bitscout – LiveCD/LiveUSB for remote forensic acquisition and analysis
  • deft – Linux distribution for forensic analysis
  • SANS Investigative Forensics Toolkit (sift) – Linux distribution for forensic analysis


  • dff – Forensic framework
  • IntelMQ – IntelMQ collects and processes security feeds
  • Laika BOSS – Laika is an object scanner and intrusion detection system
  • PowerForensics – PowerForensics is a framework for live disk forensic analysis
  • The Sleuth Kit – Tools for low-level forensic analysis
  • turbinia – Turbinia is an open-source framework for deploying, managing, and running forensic workloads on cloud platforms

Live Network Forensics Tools

  • grr – GRR Rapid Response: remote live forensics for incident response
  • Linux Expl0rer – Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask
  • mig – Distributed & real-time digital forensics at the speed of the cloud
  • osquery – SQL-powered operating system analytics


  • dc3dd – Improved version of dd
  • dcfldd – A different improved version of dd (this version has some bugs! Another version is on GitHub adulau/dcfldd)
  • FTK Imager – Free imaging tool for Windows
  • Guymager – Open source version for disk imaging on Linux systems


  • bstrings – Improved strings utility
  • bulk_extractor – Extracts information like email addresses, credit card numbers, and histograms of disk images
  • floss – Static analysis tool to automatically deobfuscate strings from malware binaries
  • photorec – File carving tool

Memory Forensics Tools

  • – High-speed memory analysis framework developed in .NET supports all Windows x64, and includes code integrity and write support.
  • KeeFarce – Extract KeePass passwords from memory
  • Rekall – Memory Forensic Framework
  • volatility – The memory forensic framework
  • VolUtility – Web App for Volatility framework
  • BlackLight – Windows/MacOS Computer Forensics tools client supporting hiberfil, pagefile, raw memory analysis.
  • DAMM – Differential Analysis of Malware in Memory, built on Volatility.
  • evolve – Web interface for the Volatility Memory Forensics Framework.
  • FindAES – Find AES encryption keys in memory.
  • – High-speed memory analysis framework developed in .NET supports all Windows x64, and includes code integrity and write support.
  • Muninn – A script to automate portions of analysis using Volatility, and create a readable report.
  • Rekall – Memory analysis framework, forked from Volatility in 2013.
  • TotalRecall – Script based on Volatility for automating various malware analysis tasks.
  • VolDiff – Run Volatility on memory images before and after malware execution, and report changes.
  • Volatility – Advanced memory forensics framework.
  • VolUtility – Web Interface for Volatility Memory Analysis framework.
  • WDBGARK – WinDBG Anti-RootKit Extension.
  • WinDbg – Live memory inspection and kernel debugging for Windows systems.

Network Forensics Tools

  • SiLK tools – SiLK is a suite of network traffic collection and Computer Forensics tools and analysis tools
  • Wireshark – The network traffic analysis tool
  • NetLytics – Analytics platform to process network data on Spark.

Windows Artifacts

  • ArtifactExtractor – Extract common Windows artifacts from source images and VSCs
  • FastIR Collector – Collect artifacts on windows
  • FRED – Cross-platform Microsoft registry hive editor
  • LogonTracer – Investigate malicious Windows logon by visualizing and analyzing Windows event log
  • MFT-Parsers – Comparison of MFT-Parsers
  • MFTExtractor – MFT-Parser
  • NTFS journal parser
  • NTFS USN Journal parser
  • RecuperaBit – Reconstruct and recover NTFS data
  • python-ntfs – NTFS analysis

OS X Forensics

  • OSXAuditor

Internet Artifacts

  • chrome-url-dumper – Dump all locally stored information collected by Chrome
  • hindsight – Internet history forensics for Google Chrome/Chromium

Timeline Analysis

  • DFTimewolf – Framework for orchestrating Computer Forensics tools collection, processing, and data export using GRR and Rekall
  • plaso – Extract timestamps from various files and aggregate them
  • timesketch – Collaborative forensic timeline analysis

Disk Image Handling

  • aff4 – AFF4 is an alternative, fast file format
  • imagemounter – Command line utility and Python package to ease the (un)mounting of forensic disk images
  • libewf – Libewf is a library and some tools to access the Expert Witness Compression Format (EWF, E01)
  • xmount – Convert between different disk image formats


  • hashcat – Fast password cracker with GPU support
  • John the Ripper – Password cracker

Learn Forensics

  • Forensic challanges – Mindmap of forensic challanges
  • Training material – Online training material by European Union Agency for Network and Information Security for different topics

Forensic CTFs Tools

  • Forensics CTFs
  • Precision Widgets of North Dakota Intrusion

There are many relatively new tools available that have been developed in order to recover and dissect the information.

This is a relatively new and fast-growing field many forensic analysts do not know or take advantage of these assets.

Also, Read

The Rise and Rise of Cybersecurity Services

Most Important Cyber Incident Response Tools List for Ethical Hackers and Penetration Testers

Windows Registry Analysis – Tracking Every Activity That You Do on the Windows System


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles