Digital Forensics Tools
Acquisition, disk and memory analysis, timeline reconstruction: the tools used in incident response and digital investigations.
Always work on a copy: compute the hash (SHA-256) of the original and the copy, and log every action to preserve the chain of custody.
Autopsy / The Sleuth Kit
Disk analysis platform: file systems, deleted files, timeline, keyword search.
Windows, Linux, macOS
Official websiteFTK Imager
Creates disk images and captures RAM, with hash computation.
Windows
Official websiteVolatility 3
The reference framework for analyzing memory dumps: processes, connections, code injection.
Windows, macOS, Linux
Official websiteKAPE
Fast, targeted collection of useful Windows artifacts (registry, logs, prefetch…) followed by automatic processing.
Windows
Official websiteEric Zimmerman’s tools
Suite of Windows artifact parsers (MFT, registry, LNK, jump lists) plus Timeline Explorer.
Windows
Official websiteVelociraptor
Collection and hunting agent at scale, driven by VQL queries, for thousands of endpoints.
Windows, macOS, Linux
Official websitePlaso (log2timeline)
Extracts timestamps from hundreds of formats to build a super timeline.
Linux, Windows, macOS
Official websiteTimesketch
Collaborative analysis of timelines produced by Plaso.
Web (auto-hébergé)
Official websiteHayabusa
Fast EVTX log analysis with Sigma rules to spot suspicious activity.
Windows, macOS, Linux
Official websiteChainsaw
Search and detection in Windows logs using Sigma rules, ideal for first triage.
Windows, macOS, Linux
Official websiteWireshark
The reference packet analyzer for studying network captures.
Windows, macOS, Linux
Official websiteMagnet AXIOM
Commercial suite covering computers, phones and cloud, used by law enforcement.
Windows
Official website