Computer Forensics

Open Computer Forensics Architecture (OCFA) is a modular computer forensics framework built by the Dutch National Police Agency. The main goal is to automate the digital forensic process to speed up the investigation and give tactical investigators direct access to the seized data through an easy...

SAFE Block is a software-based write blocker computer forensics tool for the Windows 2000/XP Operating Systems. SAFE Block facilitates the quick and safe acquisition and/or analysis of evidence on any disk or flash storage media attached directly to your forensic workstation. It has a simple...

"Blindingly fast" (Computer Forensics:Incident Response Essentials) searching of gigabytes of word processor, database, spreadsheet, ZIP, XML, PDF, HTML, emails and more. *Over two dozen indexed, unindexed, fielded and full-text search options. *Highlights hits in retrieved files; for HTML & PDF,...


Platforms: Windows

dc3dd is a patched version of GNU dd to include a number of features useful for computer forensics. Many of these features were inspired by dcfldd, but were rewritten for dc3dd. Pattern writes. The program can write a single hexadecimal value or a text string to the output device for wiping...


Platforms: *nix

Thumbs.db Viewer was written to give the computer user tools to reconstruct Thumbs.db, ehthumbs.db, thumbcache_*.db (Windows Vista,Windows 7) and iconcache_*.db (Windows 8/10) database records. Thumbs.db is a hidden system file generated automatically by Windows when you view the contents of a...


Platforms: Windows, Windows 7, Other

Fenris is a suite of tools suitable for code analysis, debugging, protocol analysis, reverse engineering, forensics, diagnostics, security audits, vulnerability research and many other purposes. The main logical components are: - Fenris: high-level tracer, a tool that detects the logic used...


Platforms: *nix

Thumbs.db Viewer was written to give the computer user tools to reconstruct Thumbs.db, ehthumbs.db, thumbcache_*.db (Windows Vista,Windows 7) and iconcache_*.db (Windows 8/10) database records. Thumbs.db is a hidden system file generated automatically by Windows when you view the contents of a...


Platforms: Windows, Windows 7

FINALeMAIL scans the email database file and locates lost emails that do not have data location information associated with them. FINALeMAIL has the capability of restoring lost emails and restoring them to their original state. Not only can FINALeMAIL recover single email messages it can also...

The "Recycle Bin" icon on your Windows desktop allows you to recover deleted files. Unfortunately, there are many possible situations when the Recycle Bin is useless. Just a few examples: Windows cannot access a disk drive. A disk volume containing valuable info was damaged due to a system...


Platforms: Windows

Data Doctor Recovery is easy safe Read-only and Non-Destructive Data recovery software tool. Data Recovery Doctor for FAT NTFS recovers data files and folders lost due to overwritten/deleted/formatted/damaged/corrupted partitions from FAT and NTFS based operating systems such as Windows...


Platforms: Windows

Windows data retrieval software is read only & non destructive tool provides full restoration of erased files folders directories-subdirectories from FAT NTFS file systems. File recovery tool provides support to recover lost or misplaced data due to damaged, corrupted, formatted partitions or...


Platforms: Windows

DEFT (acronym of Digital Evidence & Forensic Toolkit) is a customized Linux distribution of the Kubuntu live Linux CD. It is a very easy to use system that includes an excellent hardware detection and the best open source applications dedicated to incident response and computer forensics....


Platforms: *nix

Trinux is a ramdisk-based Linux distribution that boots from a single floppy or CD-ROM, loads it packages from an HTTP/FTP server, a FAT/NTFS/ISO filesystem, or additional floppies. Trinux contains the latest versions of popular Open Source network security tools for port scanning, packet...


Platforms: *nix

OSForensics is a new digital investigation tool which lets you extract forensic data or uncover hidden information from computers. OSForensics has a number of unique features which make the discovery of relevant forensic data even faster, such as high-performance deep file searching and indexing,...


Platforms: Windows

dtSearch Reviews* "The most powerful document search tool on the market"-- Wired Magazine* "dtSearch ... leads the market" -- Network Computing* "Finding a virtual needle in a digital haystack is now much easier" -- MS OfficePRO* "Blindingly fast" -- Computer Forensics: Incident Response...


Platforms: Windows

WinHex is a hexadecimal editor for Windows 95/98/Me/NT/2000/XP with a lot of features:* Disk editor (logical & physical, supports FAT16, FAT32, NTFS, and CDFS)* RAM editor - a means to edit other processes' virtual memory* Data Interpreter, knowing 19 data types* Editing data structures using...


Platforms: Windows

dtSearch Reviews* "The most powerful document search tool on the market"-- Wired Magazine* "dtSearch ... leads the market" -- Network Computing* "Finding a virtual needle in a digital haystack is now much easier" -- MS OfficePRO* "Blindingly fast" -- Computer Forensics: Incident Response...


Platforms: Windows

dtSearch Reviews * "The most powerful document search tool on the market"-- Wired Magazine * "dtSearch ... leads the market" -- Network Computing * "Finding a virtual needle in a digital haystack is now much easier" -- MS OfficePRO * "Blindingly fast" -- Computer Forensics: Incident Response...


Platforms: Windows

Comprehensive freeware data recovery application has an easy and safe solution to backup all your precious official files, compressed and zipped folders from inaccessible or faulty hard disk volume. Easy to user data regaining utility retrieves accidentally lost files due to software malfunction,...


Platforms: Windows

dtSearch Reviews * "The most powerful document search tool on the market"-- Wired Magazine * "dtSearch ... leads the market" -- Network Computing * "Finding a virtual needle in a digital haystack is now much easier" -- MS OfficePRO * "Blindingly fast" -- Computer Forensics: Incident Response...


Platforms: Windows