A selection of free computer forensic tools (forsensics)

This article provides free tools for investigating information security incidents.

Disk tools and data collection

• Arsenal Image Mounter utility for working with disk images in Windows, access to partitions and volumes, etc.
• DumpIt utility for dumping physical memory of Windows computers, 32/64 bits. Can work with a USB drive.
• EnCase Forensic Imager utility for creating EnCase evidence files.
• Encrypted Disk Detector is a utility for detecting encrypted TrueCrypt, PGP or Bitlocker volumes.
• EWF MetaEditor utility for editing EWF metadata (E01).
• FAT32 Format utility for formatting large capacity disks in FAT32.
• Forensics Acquisition of Websites is a browser designed to capture web pages for investigation.
• FTK Imager viewing and cloning media in Windows environment.
• Guymager is a multi-threaded GUI utility for creating Linux disk images.
• Live RAM Capturer is a utility for extracting a RAM dump, including a protected anti-debug or anti-dumping system.
• NetworkMiner network analysis tool for detecting OS, hostname and open ports of network nodes using packet capture / PCAP analysis.
• Magnet RAM Capture utility for capturing RAM from Windows XP to Windows 10, Win Server 2003, 2008, 2012.
• OSFClone live CD / DVD / USB utility for creating dd or AFF images.
• OSFMount utility for monitoring disk images, also allows you to create RAM-disks.

Email Analysis

• EDB Viewer is a utility for viewing EDB Outlook files without an Exchange server.
• Mail Viewer utility for viewing Outlook Express files, Windows Mail / Windows Live Mail, Mozilla Thunderbird message database and individual EML files.
• MBOX Viewer utility to view MBOX emails and attachments.
• OST Viewer utility for viewing Outlook OST files without Exchange server.
• PST Viewer utility for viewing Outlook PST files without Exchange server.

')

File and Data Analysis

• analyzeMFT is a utility for parsing MFT from the NTFS file system, allowing you to analyze the results using other tools.
• bstrings binary data search utility, including regular expression searches.
• CapAnalysis PCAP lookup utility.
• Crowd Response is a Windows console application to assist in gathering system information for incident response and security.
• Crowd Inspect utility for getting information about network processes, listing the binary files associated with each process. Creates requests for VirusTotal and other online malware analysis tools and reputation services.
• DCode utility converts various data types to date / time values.
• Defraser utility to detect complete and partial data about multimedia files in unallocated space.
• The eCryptfs Parser utility recursively analyzes the headers of each eCryptfs file in the selected directory.
• Encryption Analyzer utility for analyzing password-protected and encrypted files, analyzes the complexity of encrypting reports and decryption options for each file.
• ExifTool utility for reading and editing Exif data in a large number of file types.
• File Identifier online file type analysis (over 2000).
• Forensic Image Viewer utility to extract data from images.
• Link Parser is a recursive folder analysis utility that extracts over 30 attributes from Windows .lnk (shortcut) files.
• Memoryze analysis of RAM images, including analysis of “page” files.
• MetaExtractor utility for extracting meta-information from office documents and pdf.
• Shadow Explorer utility for viewing and extracting files from shadow copies.

Mac OS Tools

• Audit utility to output OS X auditing and logs.
• Disk Arbitrator blocks the mounting of file systems, complementing the write lock when disabling disk arbitration.
• FTK Imager CLI for Mac OS is the console version for Mac OS FTK Imager utilities.
• IORegInfo utility for displaying information on devices connected to a computer (SATA, USB and FireWire, software RAID arrays). It can determine the partition information, including the dimensions, types and bus to which the device is connected.
• mac_apt utility for working with images E01, DD, DMG.
• Volafox is a memory analysis utility on Mac OS X.

Mobile devices

• iPBA2 iOS backup analysis utility.
• iPhone Analyzer is a Pad, iPod and iPhone file structure analysis utility.
• ivMeta utility to extract phone model and software version, as well as temporary data and GPS data from iPhone video.
• Rubus utility for deconstructing Blackberry .ipd backup files.
• SAFT extract SMS, call logs and contacts from Android devices.

---

Previous articles in this series:

Computer forensics (forsensik) - a review of the tools and training sites .
Computer forensics (forsensik): a selection of useful links.