These are tools discussed Learning Ransomware Response & Recovery by W. Curtis Preston and Dr. Mike Saylor. Browse the list of all tools or get the book.
Inclusion in this directory does not indicate endorsement.
If you see a missing tool, leave a comment!
Forensic tools enable investigators to create bit-for-bit copies of storage media and analyze digital evidence while maintaining chain of custody and data integrity.
Commercial Forensics
- EnCase/EnCase Imager – https://www.opentext.com/products/forensic – Industry-standard forensic imaging and analysis
- FTK/FTK Imager – https://www.exterro.com/ftk-imager – Forensic toolkit (has free version)
- X-Ways Forensics – https://www.x-ways.net/forensics – Fast forensic imaging and analysis platform
- Cellebrite UFED – https://cellebrite.com/en/ufed – Mobile and computer forensic imaging
- Magnet AXIOM – https://www.magnetforensics.com/products/magnet-axiom – Modern digital forensics platform
- Tableau – https://www.opentext.com/products/tableau-forensic-bridges – Hardware write blockers
- FireEye Redline – https://fireeye.market/apps/211364 – Memory and file analysis tool
Free/Open Source Forensics
- dd – Built-in Linux/Unix utility – Command-line disk imaging utility
- Guymager – https://guymager.sourceforge.io – GUI-based disk imaging tool for Linux
- DEFT Linux – https://archiveos.org/deft/ – Complete forensic toolkit distribution
- Autopsy – https://www.autopsy.com – Open-source digital forensics platform
- PALADIN – https://sumuri.com/software/paladin – Purpose-built Linux forensic distribution
- WinFE – https://www.microsoft.com/en-us/download – Bootable Windows forensic environment (via Windows ADK)
- CAINE – https://www.caine-live.net – Complete forensic toolkit on bootable Linux
- DumpIt – https://www.comae.com – Windows memory capture tool
- Volatility Framework – https://www.volatilityfoundation.org – Memory forensics analysis