Free Computer Forensic Software's list - by Forensic Control

Forensic Control, a London-based cybersecurity & computer forensics company, created this public list of free
computer forensic software in 2011. It was last updated on 29 November 2017. This is the last version of the list – it
will no longer be updated,
Forensic Control provides no support or warranties for the listed software, and it is the user’s responsibility to verify
licensing agreements. Inclusion on the list does not equate to a recommendation. Using forensic software does not,
on its own, make the user a forensic analyst or the output court admissible. Publishing the whole or part of this list
is licensed under the terms of the Creative Commons – Attribution Non-Commercial 4.0 license.

1. FORENSIC

CYBER SECURITY & RISK MANAGEMENT

2

nl ul ri TNT pany

2. nal jounts disk images as complete disks in Windows, giving a

Guidance reate EnCase evidence files and EnCase lo

oftware

Edit EWF (E01) meta data,

ser designed to forensically capture web pat

imager under running under Linu

[direct

‚load link]

3. Network analysis tool. Detect siname and open ports of network hosts

packet sniffing/PCAP parsing,

Captures physical memon uspect's computer. V x 0, and

2003, 2008, 2012. 32 & 64 bit.

Mounts a wide range of disk images. Also a

Lepide Softwar en and view (not export) Outlook EDB files without an E:

4. multiple files using Boolean operators and Perl Re

nlocatic file comparison, verification, logging,

5. DS and SHA1 hashes

Arkane Systems Automatically moves mouse pointer stopping screen saver, hibernation etc

Enables software write-blocking of USB ports.

eating and working with a

6. Allan Hay a a and Wind

Find strings in binary data, including regular expr

Nindows console application to aid gathering of system information for incident

response and security en

tal Detective nverts various data t

Recursivel ders of every eCryptts file in selected directory. Outputs

encryption algorithm used, original file si

7. Phil Harvey dit Exif data in a large number of filetypes.

Ian 9 files using text, graphic or hist

View and expo:

Network packet capture an

cursively pars: xtract meta data from MS C enOffice and PDF

Lists EXIF, and where available, GPS data for all photographs present in a directo

Export data to .xis or Google Earth KML format.

8. je and extract

Analyse 1

fortext

ch, INFO2 ar

9. Blackbag Lists items connected to the computer (e... SATA, USB and FireWire Drives, software
RAID sets). Can locate partition information, including sizes, types, and the bus to

h the onnected.

lackbag Displays the physical partitioning of the specified device. Can be used to map out al

the drive information, accounting for all used sectors.

10. from Android devices.

11. Nanni Bassett!

Linux based live CD, featuring a number of analysis tool

Analyses volumes, file systems, user and applications data, extracting metadata,
deleted and hi

Comprehensive penetration testing pl

are Appliance pre-configured with multiple t wing digital forensic

inatio

acts from RAM.

12. (not save or export contents up files.

xport from) E01 files & vie ithin EDB, PST 8 OST

SysTool v e or export) MSG file emails and attachments

View most multimedia files and DVD, Audio CD, VCD, e

13. Software Captures history from Firefox, Chrome, Internet Explorer and Edc

running on Windows computers.

Python module for performing off-line parsing of Chrom:

Session”, “Last "Current Tabs”, "Last Tabs’)

Extracts embe:

used as well as dates of and the num!

1 publicly available in F4

Extract s rom Internet Explorer ver

Current

14. arses the cookie folder of Firefox

mad search engines (Google ‘and MSN)

orking sites (Twitter, Fac

pera ser, and displays the list of

Reviews list o inthe history files of the m

15. Dumps list of shi

modification dates.

Examine W

For the acquisition,

Presents visual repr

Additionally

entries showi

ses and registry threads in real time.

analysis, and reporting of registry contents.

tion and correlation tool

of what a users directory structure looked like.

various timestamps (8.9. first explored, las!

16. 0+ attributes relating to USB dei

idler Steven: Displays list of programs run, with run count and last run date and time.

ne Dropbox flecache.dbx file which stores information about files that have

‚ed to the cloud using Dropbox.

17. Extracts various data from the KaZaA application

Nirsoft

Nirsoft xtracts recently visited Intemet Expl