15+ best and free computer forensic tools


In this article, I decided to collect programs that will help you in conducting investigations and will be free at the same time.

NirSoft Utility’s

Our list opens with a site that presents a selection of several hundred different free utilities for a forensic specialist. Everything is here, from Windows password recovery to network tools. Most of the tools do not require installation and work without leaving any traces. Everyone can find here something that will help him in a particular situation.

Link: https://www.nirsoft.net/

BULK_EXTRACTOR

A great tool that allows you to scan disk images, files, file directories, etc.) and extract structured information from them, such as email addresses, phone numbers, credit card numbers, GPS coordinates, fragments of JPEG and JSON files without parsing or file system structures.

Link: https://github.com/simsong/bulk_extractor

SHERLOQ

A whole set of useful tools for the examination of electronic images in one bottle. The service applies the latest research algorithms to graphic files, which allows not only to determine their authenticity, but also to receive a detailed technical conclusion about the verification.

Link: https://github.com/GuidoBartoli/sherloq

VIDEOCLEANER

Allows you to analyze photo and video files of most formats. It is very useful for investigations, as it makes it possible to improve the quality of displaying faces, license plates and other objects. It improves the quality and brightness of the image, changes the saturation and eliminates distortion.

Link: https://videocleaner.com/

ArtEx (Artifact Examiner)

A useful forensic tool that allows you to visualize the contents of iOS smartphones, as well as extract data. Works with a jailbroken device or a pre-cooked image. Allows you to build timelines, analyze movements between cell towers with visualization on the map. Parses messengers, analyzes transactions and recognizes faces in photos.

Link: http://doubleblak.com/

Andriller

Utility with a set of forensic tools for Android smartphones. Allows you to extract and decode device data. Reveals password protection at the entrance to the gadget. Has customizable decoders for application data from android databases to decode messages.

Link: https://github.com/den4uk/andriller

MOBILedit

A phone copy app for any operating system that helps you transfer contacts and messages from other phones, create local content backups, and manage your phone on a PC via Wi-Fi.

Link: https://www.mobiledit.com/app-mobiledit

HINDSIGHT

A tool for the examination of browsers based on the Chromium engine. Collects and analyzes web browser artifacts. Allows you to work with download history, cache entries, bookmarks, autofill entries, saved passwords, settings, extensions, cookies. Conveniently organizes records and lays them out on a timeline.

Link: https://github.com/obsidianforensics/hindsight

HackBrowserData

Open Source product that allows you to extract data from a whole line of browsers (Chrome/Chromium, Microsoft Edge, QQ, Brave, Opera, Vivaldi, Ynadex and FireFox). Successfully pulls out passwords, bookmarks, history, download links, cookies and much more.

Link: https://github.com/moonD4rk/HackBrowserData

XPLICO

A tool that allows you to analyze network traffic (HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, IPv6, Facebook, MSN, RTP, IRC, Paltalk, etc.). An extremely useful tool for forensics.

Link: http://xplico.org/

FILE IDENTIFIER

A utility that allows you to recognize unknown files on a Windows computer. Allows you to search for information about any Windows file using the context menu option. In total, the tool recognizes more than 2000 file types from its own database.

Link: https://windowsfileviewer.com/file_identifier

OSF clone

A tool that allows you to quickly and independently of the installed operating system create or clone accurate raw disk images. Supports disk images in the open Advance Forensics Format (AFF). Able to create a forensic disk image, preserving all unused sectors, free space, file fragmentation and undeleted file records from the original hard disk.

Link: https://www.osforensics.com/tools/create-disk-images.html

Autopsy

An absolute favorite that needs no introduction. A complete digital forensics platform with its own GUI. Used by law enforcement, military and corporate experts. The platform has been designed to work with third party modules.

Link: http://sleuthkit.org/autopsy/

Avilla Forensics

A good example of how a handy tool for mobile platform forensics can be free. Interacts with a mobile device through the ADB interface, creating a full backup, as well as installing its own agent for real-time data parsing. At the same time, it perfectly parses a bunch of information from completely different sources.

Link: https://github.com/AvillaDaniel/AvillaForensics

iLEAPP

Log, event and Plist parser for iOS 11–14. If you have ever been digging in iPhone plist files, then you will fully appreciate this software.

Link: https://github.com/abrignoni/iLEAPP

ForensicWiki

And finally, a whole web resource in Wiki format dedicated to digital forensics. Here you can find answers to almost any questions that interest you.

Link: https://forensicswiki.xyz

Igor S. Bederov

Comments

Post a Comment

Popular posts from this blog

OSINT by nickname…

Image
OSINT by nickname is the process of collecting and analyzing information about a nickname on the Internet. Thanks to this collection method, we can build a chain of all mentions on the Internet, be it social networks or websites. WhatsMyName — a simple, fast and reliable service. Presented as an online service and open source software . Checks the presence of a nickname (strict compliance only) on 600 web resources. Also displays results from Google’s main search results and document searches. It does not provide additional types of search. Maigret is a more advanced service. Presented in the form of a Telegram bot and open source software . Checks the presence of a nickname (strict compliance only) on 3000 web resources. Allows you to upload an extended report on the inspection performed, including additional data on identified profiles. It does not provide additional types of search. mailcat is a service designed to search for the use of a nickname as part of an electronic address...
Read more

Top of my free OSINT tools in 2023

Image
In this article, we will look at the tools that are used every day in my work related to the investigation of crimes. Last year was tough but interesting. Some developments stopped working in Russia. Many, on the contrary, were created in our country. Including with my participation. So let’s go! Datashare and Pinpoint Datashare Pinpoint Datashare and Pinpoint are for eDiscovery… The term is unfamiliar for Russia, so I’ll explain it. eDiscovery is the process of identifying, collecting, validating, and analyzing digital evidence. If it is quite simple — the electronic material of the investigation. Compare, 10 volumes of a criminal case or a link to a similar case that can be shared online with external users, and it also has the ability to end-to-end analytics and search through materials. In other words, a must have for the execution of investigations. Archivarius 3000 and DtSearch Archivarius 3000 DtSearch Archivarius 3000 and DtSearch are designed to work with arrays of textual...
Read more

Military intelligence using OSINT methods

Image
As practice shows, modern armed conflicts require new approaches to organizing the collection and analysis of open data, which we operate within the framework of OSINT. In this article, we will look at various tools that can be used in the context of frontline reconnaissance and the collection of information about what is happening in the war zone from open sources. DISCLAIMER : This article is for informational purposes only and is not intended to be a guide to misconduct or educational material for covering up wrongdoing. To begin with, let’s define the very concept of front-line intelligence. Its main goals are to obtain information about the deployment and movements of enemy formations, their weapons and equipment, personnel, combat missions and held settlements. And in the conditions of modern conflicts, a significant part of this information can be obtained by organizing constant monitoring of the Internet. So, let’s figure out what categories of data will fall into our condition...
Read more