Free Computer Forensics Software, Tools & Utilities

 >  Resources  >  Free Software List

Free Forensics Software – The Ultimate List

Sometimes forensic examiners need a list of free forensics software to strengthen their investigation. Fortunately, we have developed and provided an extensive list of free forensics software and tools.

Free Computer Forensics Software


The following free forensic software list was developed over the years, and with partnerships with various companies. Feel free to browse the list and download any of the free forensic tools below.

Browse free computer forensics software and utilities by category below:


Disk Tools & Data Capture

Below is a list of commonly used free forensic disk tools and data capture tools. These allow you to image a media and to capture the data for preservation.

SOFTWAREDEVELOPED BYDESCRIPTION
Arsenal Image MounterArsenal Consulting, Inc.Mounts disk images as complete disks in Windows, giving access to Volume Shadow Copies, etc.
DumpItMoonSolsGenerates physical memory dump of Windows machines, 32 bits 6 bit. Can run from a USB flash drive.
EnCase Forensic ImagerGuidance SoftwareCreate EnCase evidence files and EnCase logical evidence files
Encrypted Disk DetectorMagnet ForensicsChecks local physical drives on a system for TrueCrypt, PGP, or Bitlocker encrypted volumes.
EWF MetaEditor4DiscoveryEdit EWF (E01) meta data, remove passwords (EnCase v6 and earlier).)
FAT32 FormatRidgecropEnables large capacity disks to be formatted as FAT32.
Forensics Acquisition of WebsitesWeb Content Protection AssociationBrowser designed to forensically capture web pages.
FTK ImagerAccessDataImaging tool, disk viewer and image mounter.
Guymagervogu00Multi-threaded GUI Imager running under Linux.
Live RAM CapturerBelkasoftExtracts RAM dump including that protected by an anti-debugging or anti-dumping system. with 32 and 64 bit builds.
NetworkMinerHjelmvikNetwork analysis tool. Detects OS, hostname and open ports of network hosts through packet sniffing/PCAP parsing.
NmapNmapUtility for network discovery and security auditing.
Magnet RAM CaptureMagnet ForensicsCaptures physical memory of a suspect's computer. Windows XP to WIndows 10, and 2003, 2008, 2012. 32 & 64 bit.
OSFClonePassmark SoftwareBoot utility for CD/DVD or USB flash drives to create dd or AFF images and clones.
OSFMountPassmark SoftwareMounts a wide range of disk images. Also allows creation of RAM disks.
WiresharkWiresharkNetwork protocol capture and analysis
Disk2vhdMicrosoftCreates Virtual Hard Disks versions of physical disks for use in Microsoft Virtual PC or Microsoft Hyper-V VMs

E-Mail Analysis

Below are free tools for forensic email analysis. These tools can help with the different aspects of forensic email analysis including identifying and organizing the path between sender and recipient, analyzing attachments, categorizing and mapping out emails, and so forth.

SOFTWAREDEVELOPED BYDESCRIPTION
EDB ViewerLepide SoftwareOpen and view (not export) Outlook EDB files without an Exchange server.
Mail ViewerMiTeCViewer for Outlook Express, Windows Mail / Windows Live Mail, Mozilla Thunderbird message databases and single EML files.
Email Header Analysis (RCCF)RCCFTool for tracking email sender's identity, analyzes header and gives details like IP address, mail service, provider, etc.
MBOX ViewerSysToolsView MBOX emails and attachments.
OST ViewerLepide SoftwareOpen and view (not export) Outlook PST files without connecting to an Exchange server.
PST ViewerLepide SoftwareOpen and view (not export) Outlook PST files without needing Outlook.

File and Data Analysis

Windows and other operating systems store user data in files with unique format and encoding. Usually specific to one type, these free tools are used to decode those files.

SOFTWAREDEVELOPED BYDESCRIPTION
Advanced PrefetchAnayserAllan HayReads Windows XP, Vista and Windows 7 prefetch files.
AnalyzeMFTDavid KovarParses the MFT from an NTFS file system allowing results to be analysed with other tools.
bstringsEric ZimmermanFind strings in binary data, including regular expression searching.
CapAnalysisrEvolkaPCAP viewer.
Crowd ResponseCrowdStikeWindows console application to aid gathering of system information for incident response and security engagements.
Crowd InspectCrowdStrikeDetails network processes, listing binaries associated with each process. Queries VirusTotal, other malware repositories & reputation services to produce “at-a-glance” state of the system.
DCodeDigital DetectiveConverts various data types to date/time values.
DefraserVariousDetects full and partial multimedia files in unallocated space.
eCryptfs ParserTed TechnologyRecursively parses headers of every eCryptfs file in selected directory. Outputs encryption algorithm used, original file size, signature used, etc.
Encryption AnalyzerPasswareScans a computer for password-protected & encrypted files, reports encryption complexity and decryption options for each file.
ExifToolPhil HarveyRead, write and edit Exif data in a large number of file types.
File IdentifierToolsley.comDrag and drop web-browser JavaScript tool for identification of over 2000 file types.
Forensic Image ViewerSanderson ForensicsView various picture formats, image enhancer, extraction of embedded Exif, GPS data. Can be downloaded after registering on the forum.
GhiroAlessandro TanasiIn-depth analysis of image (picture) files.
HighlighterMandiantExamine log files using text, graphic or histogram views.
Link Parser4DiscoveryRecursively parses folders extracting 30+ attributes from Windows .lnk (shortcut) files.
LiveContactsViewNirsoftView and export Windows Live Messenger contact details.
PECmdEric ZimmermanPrefetch Explorer.
RSA Netwitness InvestigatorEMCNetwork packet capture and analysis.
MemoryzeMandiantAcquire and/or analyse RAM images, including the page file on live systems.
MetaExtractor4DiscoveryRecursively parses folders to extract meta data from MS Office, OpenOffice and PDF files.
MFTviewSanderson ForensicsDisplays and decodes contents of an extracted MFT file. Can be downloaded after registering for forum.
PictureBoxMike’s Forensic ToolsLists EXIF, and where available, GPS data for all photographs present in a directory. Export data to .xls or Google Earth KML format.
PsToolsMicrosoftSuite of command-line Windows utilities.
Shadow ExplorerShadow ExplorerBrowse and extract files from shadow copies.
SQLite ManagerMrinal Kant, Tarakant TripathyFirefox add-on enabling viewing of any SQLite database.
StringsMicrosoftCommand-line tool for text searches.
Structured Storage ViewerMiTecView and manage MS OLE Structured Storage based files.
Windows File AnalyzerMiTecAnalyse thumbs.db, Prefetch, Windows File MiTeC INFO2 and .lnk files.
XplicoGianluca Costa & Andrea De FranceschiNetwork forensics analysis tool.

Mac OS Tools

Mac OS X and it’s many other versions store user data in files with unique format and encoding. Usually specific to one type, these free tools are used to decode those files.

SOFTWAREDEVELOPED BYDESCRIPTION
AuditrTwocanoesAudit Preference Pane and Log Reader for OS X.
Disk ArbitratorAaron BurghardtBlocks the mounting of file systems, complimenting a write blocker in disabling disk arbitration.
Epoch ConverterBlackbag TechnologiesConverts epoch times to local time and UTC.
FTK Imager CLI for Mac OSAccessDataCommand line Mac OS version of AccessData’s FTK Imager.
IORegInfoBlackbag TechnologiesLists items connected to the computer (e.g., SATA, USB and FireWire Drives, software RAID sets). Can locate partition information, including sizes, types, and the bus to which the device is connected.
mac_aptYogesh Khatri, Champlain CollegeMac OS triage tool, works usable against E01, DD, DMG and mounted images
PMAP InfoBlackbag TechnologiesDisplays the physical partitioning of the specified device. Can be used to map out all the drive information, accounting for all used sectors.
VolafoxKyeongsik LeeMemory forensic toolkit for Mac OS X

Mobile Devices

Because they safeguard user data differently, mobile phones require different tools for acquisition or analysis. The free tools listed here are designed to conduct these operations for a specific mobile phone model or OS.

SOFTWAREDEVELOPED BYDESCRIPTION
iPBA2Mario PiccinelliExplore iOS backups.
iPhone AnalyzerLeo Crawford, Mat ProudExplore the internal file structure of Pad, iPod and iPhones.
ivMetaRobin WoodExtracts phone model and software version and created date and GPS data from iPhone videos.
RubusCCL ForensicsDeconstructs Blackberry .ipd backup files.
SAFTSignalSEC CorpObtain SMS Messages, call logs and contacts from Android devices.

Data Analysis Suites

Data Analysis Suites combine the functions of individual applications into an integrated interface or applications. Data Analysis Suites allow analysts to sort through data quickly and efficiently while maintaining case data in one single location.

SOFTWAREDEVELOPED BYDESCRIPTION
AutopsyBrian CarrierGraphical interface to the command line digital investigation analysis tools in The Sleuth Kit
BacktrackBacktrackPenetration testing and security audit with forensic boot capability. Now is a part of Kali Linux.
CaineNanni BassettiLinux based live CD, featuring a number of analysis tools.
DeftDr. Stefano Fratepietro and othersLinux based live CD, featuring a number of analysis tools.
Digital Forensics FrameworkArxSysAnalyses volumes, file systems, user and applications data, extracting metadata, deleted and hidden items.
Forensic ScannerHarlan CarveyAutomates ‘repetitive tasks of data collection’.
Kali LinuxOffensive SecurityComprehensive penetration testing platform
PaladinSumuriUbuntu based live boot CD for imaging and analysis.
SIFTSANSAnalyses volumes, file systems, user and applications data, extracting metadata, deleted and hidden items.
The Sleuth KitBrian CarrierCollection of UNIX-based command line file and volume system forensic analysis tools.
Volatility FrameworkVolatile SystemsCollection of tools for the extraction of artefacts from RAM.

File Viewers

Instead of launching individual applications for each file type that requires review, sometimes it’s possible to use one application to view many types of files. “One size fits all” file viewers allow an examiner to efficiently review user-generated files or Web artifacts.

SOFTWAREDEVELOPED BYDESCRIPTION
BKF ViewerSysToolsView (not save or export from) contents of BKF backup files.
DXL ViewerSysToolsView (not save or export) Loutus Notes DXL file emails and attachments.
E01 ViewerSysToolsView (not save or export from) E01 files & view messages within EDB, PST & OST files.
MDF ViewerSysToolsView (not save or export) MS SQL MDF files.
MSG ViewerSysToolsView (not save or export) MSG file emails and attachments.
OLM ViewerSysToolsView (not save or export) OLM file emails and attachments.
Microsoft PowerPoint 2007ViewerMicrosoftView PowerPoint presentations.
Microsoft Visio 2010 ViewerMicrosoftView Visio diagrams.
VLCVideoLANView most multimedia files and DVD, Audio CD, VCD, etc.

Internet Analysis

Internet Analysis applications are designed to decode and tabulate the files that keep track of Web browsing, email, or chat. Typically created by a Web browser or dedicated application, the user activity stored within usually requires decoding specific to it. Internet Analysis tools decode the data and process it into a review-able format.

SOFTWAREDEVELOPED BYDESCRIPTION
Browser History CapturerFoxton SoftwareCaptures history from Firefox, Chrome, Internet Explorer and Edge web browsers running on Windows computers.
Browser History ViewerFoxton SoftwareExtract, view and analyse internet history from Firefox, Chrome, Internet Explorer and Edge web browsers.
Chrome Session ParserCCL ForensicsPython module for performing off-line parsing of Chrome session files (“Current Session”, “Last Session”, “Current Tabs”, “Last Tabs”).
ChromeCacheViewNirsoftReads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache.
Cookie CutterrMike’s Forensic ToolsExtracts embedded data held within Google Analytics cookies. Shows search terms used as well as dates of and the number of visits.
DumpzillarBusindreRuns in Python 3.x, extracting forensic information from Firefox, Iceweasel and Seamonkey browsers. See manual for more information.
Facebook Profile SaverBelkasoftCaptures information publicly available in Facebook profiles.
IECookiesViewNirsoftExtracts various details of Internet Explorer cookies.
IEPassViewNirsoftExtract stored passwords from Internet Explorer versions 4 to 8.
MozillaCacheViewNirsoftReads the cache folder of Firefox/Mozilla/Netscape Web browsers.
MozillaCookieViewNirsoftParses the cookie folder of Firefox/Mozilla/Netscape Web browsers.
MozillaHistoryViewNirsoftReads the history.dat of Firefox/Mozilla/Netscape Web browsers, and displays the list of all visited Web page.
MyLastSearchNirsoftExtracts search queries made with popular search engines (Google, Yahoo and MSN) and social networking sites (Twitter, Facebook, MySpace).
PasswordFoxrNirsoftExtracts the user names and passwords stored by Mozilla Firefox Web browser.
OperaCacheViewNirsoftReads the cache folder of Opera Web browser, and displays the list of all files currently
stored in the cache.
OperaPassViewNirsoftDecrypts the content of the Opera Web browser password file, wand.dat
Web HistorianMandiantReviews list of URLs stored in the history files of the most commonly used browsers.
Web Page SaverMagnet ForensicsCaptures how web pages look at a specific point in time. Requires a form to fill out prior to download.

Application Analysis

These tools allow an analyst to decode an application and analyze its intended function or decode its stored user data and preferences.

SOFTWAREDEVELOPED BYDESCRIPTION
AppCompatCache ParserEric ZimmermanDumps list of shimcache entries showing which executables were run and their modification dates.
ForensicUserInfoWoanwareExtracts user information from the SAM, SOFTWARE and SYSTEM hives files and decrypts the LM/NT hashes from the SAM file.
Process MonitorMicrosoftExamine Windows processes and registry threads in real time.
RECmdEric ZimmermanCommand line access to offline Registry hives. Supports simple & regular expression searches as well as searching by last write timestamp.
Registry DecoderUS National Institute of Justice, Digital Forensics SolutionsFor the acquisition, analysis, and reporting of registry contents.
Registry ExplorerEric ZimmermanOffline Registry viewer. Provides deleted artefact recovery, value slack support, and robust searching.
RegRipperHarlan CarveyRegistry data extraction and correlation tool.
RegshotRegshotTakes snapshots of the registry allowing comparisons e.g., show registry changes after installing software.
ShellBagsExplorerEric ZimmermanPresents visual representation of what a user’s directory structure looked like. Additionally exposes various timestamps (e.g., first explored, last explored for a given folder.
USB DeviceWoanwareDetails previously attached USB devices on exported registry hives.
USB Historian4DiscoveryDisplays 20+ attributes relating to USB device use on Windows systems.
USBDeviewNirsoftDetails previously attached USB devices.
User Assist Analysis4DiscoveryExtracts SID, User Names, Indexes, Application Names, Run Counts, Session, and Last Run Time Attributes from UserAssist keys.
PasswordFoxNirsoftExtracts the user names and passwords stored by Mozilla Firefox Web browser.
UserAssistDidier StevensDisplays list of programs run, with run count and last run date and time.
Arsenal Image MounterMiTecExtracts configuration settings and other information from the Registry.

Registry Analysis

Specific to Windows, the registry is the central repository of Windows configuration, application settings, and user preferences. Registry analysis tools decode the proprietary hives and assist an analyst with reviewing keys pertinent to their analysis.

SOFTWAREDEVELOPED BYDESCRIPTION
Dropbox DecryptorMagnet ForensicsDecrypts the Dropbox filecache.dbx file which stores information about files that have been synced to the cloud using Dropbox. Tool can be downloaded after filling out a form.
Google Maps Tile InvestigatorMagnet ForensicsTakes x,y,z coordinates found in a tile filename and downloads surrounding tiles providing more context. Tool can be downloaded after filling out a form.
KaZAlyserSanderson ForensicsExtracts various data from the KaZaA application.
LiveContactsViewNirsoftView and export Windows Live Messenger contact details.
SkypeLogViewNirsoftView Skype calls and chats.

Miscellaneous

Below is the list of additional miscellaneous software and tools that we have utilized and found useful over the years.

SOFTWAREDEVELOPED BYDESCRIPTION
Agent RansackMythicsoftSearch multiple files using Boolean operators and Perl Regex.
Computer Forensic Reference Data SetsNISTCollated forensic images for training, practice and validation.
EvidenceMoverNuixCopies data between locations, with file comparison, verification, logging.
FastCopyShirouzu HiroakiSelf labeled "fastest" copy/delete Windows software. Can verify with SHA-1. etc.
File SignaturesGary KesslerTable of file signatures.
HexBrowserPeter FiskerstrandIdentifies over 100 file types by examining their signatures.
HashMyFilesNirsoftCalculate MD5 and SHA1 hashes.
MobaLiveCDMobatekRun Linux live CDs from their ISO image without having to boot to them.
Mouse JigglerArkane SystemsAutomatically moves mouse pointer stopping screen saver, hibernation etc...
Notepad++Notepad++Advanced Notepad replacement.
NSRLNISTHash sets of "known" (ignorable) files.
Quick HashTed TechnologyA Linus & Windows GUI for individual and recursive SHA1 hashing of files.
USB Write BlockerDSiEnables software write-blocking of USB ports.
VolixFH AachenApplication that simplifies the use of the Volatility Framework.
Windows Forensic EnvironmentTroy LarsonGuide by Brett Shavers to creating and working with a Windows boot CD.

For Reference

Below are some valuable resources and references that you might find useful when researching digital forensics.

REFERENCEDEVELOPED BYDESCRIPTION
HotSwapKazuyuki NakayamaSafely remove SATA disks similar to the "Safely Remove Hardware" icon in the notification area.
iPhone Backup BrowserRene DevichiView unencrypted backups of IPad, iPod and iPhones.
IEHistoryViewNirsoftExtracts recently visited Internet Explorer URLs.
LiveViewCERTAllows examiner to boot dd images in VMware.
Ubuntu GuideHow-To GeekGuide to using Ubuntu live disk to recover partitions, carve files, etc.
WhatsApp ForensicsZena ForensicsExtract WhatsApp messages from iOS and Android backups

While these tools are essential and considered the top tools in digital, computer, and mobile forensics our forensics experts also have many more tools that they use on a daily basis. Digital forensics and investigations usually involve a range of tools. If you are looking for certified digital forensics experts then feel free to give us a call at 800-288-1407.

 

To get started choose from immediate options.

Call our 24/7 toll-free hotline to speak directly with a forensics expert. Alternatively use our simple online form to set up a new case and we will contact you shortly.