Forensics

It's an acronym for "Open Digital Evidence Search and Seizure Architecture" The intent of this project is to provide a completely open and extensible suite of tools for performing digital evidence analysis as well as a means of generating a usable report detailing the analysis and any findings....

Ubuntu Rescue Remix is a GNU/Linux live system which runs from CD or USB flash device. It provides the data recovery specialist with a command-line interface environment equipped with the best free-libre, open source data recovery and forensics tools available.

dc3dd is a patched version of GNU dd to include a number of features useful for computer forensics. Many of these features were inspired by dcfldd, but were rewritten for dc3dd. Pattern writes. The program can write a single hexadecimal value or a text string to the output device for wiping...


Platforms: *nix

FINALeMAIL scans the email database file and locates lost emails that do not have data location information associated with them. FINALeMAIL has the capability of restoring lost emails and restoring them to their original state. Not only can FINALeMAIL recover single email messages it can also...

Archive Event Logs from multiple machines to a central database. Monitor for changes to files, the registry, users, groups, services, security policies, and more. Restore files and the registry from snapshots. Schedule jobs to monitor the network for critical changes, optionally generating...


Platforms: Windows

Disk Investigator helps you to discover all that is hidden on your computer hard disk. It can also help you to recover lost data. Display the true drive contents by bypassing the operating system and directly reading the raw drive sectors. View and search raw directories, files, clusters, and...


Platforms: Windows

The "Recycle Bin" icon on your Windows desktop allows you to recover deleted files. Unfortunately, there are many possible situations when the Recycle Bin is useless. Just a few examples: Windows cannot access a disk drive. A disk volume containing valuable info was damaged due to a system...


Platforms: Windows

Data Doctor Recovery is easy safe Read-only and Non-Destructive Data recovery software tool. Data Recovery Doctor for FAT NTFS recovers data files and folders lost due to overwritten/deleted/formatted/damaged/corrupted partitions from FAT and NTFS based operating systems such as Windows...


Platforms: Windows

Paraben's SIM Card Seizure is a forensic analysis tool used to acquire and examine data from a SIM Card. Used by forensic experts around the world, SIM Card Seizure can not only analyze data on the card, it can recover deleted items such as SMS/Text messages, verify data integrity with hash...


Platforms: Windows

NoClone - file mangement utility software to find and delete TRUE duplicate files Features: * True Byte-to-byte comparison , not by CRC/MD5. Why most accurate? * Search duplicate files contents and similar files regardless of file name * Search duplicate pictures (jpg, gif), video...


Platforms: Windows

Chatting online is not just a passing phase. More and more people are communicating through chat. And that means loads of digital evidence. As an examiner, you need a specialized tool to perform a thorough analysis of chat logs. Paraben's Chat Examiner is another specialized component of...


Platforms: Windows

Thumbs.db Viewer was written to give the computer user tools to reconstruct Thumbs.db, ehthumbs.db, thumbcache_*.db (Windows Vista,Windows 7) and iconcache_*.db (Windows 8/10) database records. Thumbs.db is a hidden system file generated automatically by Windows when you view the contents of a...


Platforms: Windows, Windows 7, Other

Perform logical and physical forensic extractions of mobile phone & device data such as iPhone, iPads, Androids, BlackBerry, & more. Forensically acquire user data such as contacts, call logs, SMS, MMS, pictures, videos, and much more. Recovers deleted cell phone data. Also suppcertain Nokia,...


Platforms: Windows, Windows 7

Windows data retrieval software is read only & non destructive tool provides full restoration of erased files folders directories-subdirectories from FAT NTFS file systems. File recovery tool provides support to recover lost or misplaced data due to damaged, corrupted, formatted partitions or...


Platforms: Windows

Kernel for CD-DVD has got explorer like interface which allows easy access, to all the files and folders per file-system. Easily access data from older sessions, access data that your OS (e.g. Windows) does not see or hides from you etc. Combine this all-revealing functionality with far better...


Platforms: Windows

Log Server and Analysis Platform Quickly Isolate Applications and IT problems. Reduce operations cost, Prevent Business Loss, Correlate, Search and Report Any Type of Log. -IT Systems and Applications generate huge volumes of Log Data. -Logs and IT Data contain critical information on...


Platforms: Windows, *nix

DEFT (acronym of Digital Evidence & Forensic Toolkit) is a customized Linux distribution of the Kubuntu live Linux CD. It is a very easy to use system that includes an excellent hardware detection and the best open source applications dedicated to incident response and computer forensics....


Platforms: *nix

STD is a Linux-based Security Tool. Actually, it is a collection of hundreds if not thousands of open source security tools. Its a Live Linux Distro, which means it runs from a bootable CD in memory without changing the native operating system of the host computer. Its sole purpose in life is to...


Platforms: *nix

Distributed Aide Runtime Controller is a multi-threaded Python application designed for managing AIDE installations in large heterogeneous networks. AIDE is an open-source improvement upon the academic release of Tripwire. It can be used to detect filesystem changes in unix environments, which...


Platforms: *nix

Browser History Viewer allows you to examine the contents of web browser history files and export the data. Currently it supports Internet Explorer and Mozilla/Firefox. Browser History Viewer meant to be a forensics tool. It meant to be a forensics tool. BHV is licensed under the terms of...


Platforms: *nix