Digital Forensics Resources

Open source digital forensics platform and GUI for The Sleuth Kit. Used worldwide by law enforcement.

Library and collection of command line tools for investigating disk images.

Free tool to preview recoverable data and create forensic images without altering evidence.

Open source solution for mounting disk image contents as complete disks in Windows.

The world's most widely used memory forensics framework.

Collect host-based state information using VQL queries for DFIR and threat hunting.

Fast Windows event log forensics timeline generator and threat hunting tool.

The world's foremost network protocol analyzer for real-time traffic capture and analysis.

PCAP files, malware samples, and detailed network traffic analysis tutorials.

Kroll Artifact Parser and Extractor — efficient triage tool for forensic artifacts.

The Cyber Swiss Army Knife — web app for encryption, encoding, compression and data analysis.

Comprehensive list of forensic resources including tools, articles, courses, and useful links.

A DFIR image compendium — publicly available test data for the DFIR community.

Latest research papers and whitepapers on DFIR techniques and incident response.

The largest provider of cybersecurity training, certifications, and resources in the world.

Scientific Working Group on Digital Evidence — standards body for digital forensics.