Volatility examines the runtime state of an endpoint and allows an analyst to see what programs are residing in memory and how they are interacting with the rest of the system. Why do you need so many different tools? Mainly because they are very specialized and do different things. It includes Volatility (for in-memory analysis), Autopsy + SleuthKit and bulk extractor tools (for hard drives and smartphone analysis), along with dozens more. Because SIFT is also used by several SANS courses, a ready-made community is there to help you learn how to use it. It has been assembled by an international team of security experts, led by SANS instructor Robert Lee. It is a suite of more than a dozen different tools, chosen because they serve specific purposes. The first place to start is to download the SANS Investigative Forensic Toolkit (SIFT). I have also indicated where free or limited-time evaluation tools are available. I have partitioned them into five categories: overall analysis suites, disk imagers, live CDs, network analysis tools, e-discovery and specialized tools for email and mobile analysis. Brett Shaver’s DFIR Training website is a comprehensive listing of tools and training resources for examiners and incident responders.Īs you look through these tools, it can be overwhelming to pick the right products.It is maintained by an independent editorial staff.

The Forensics Wiki, a huge collection of resources that includes tools, techniques, links to forensics researchers and other reference materials.Two near encyclopedic sources provide listings of these tools: Although every toolset is different depending on an organization’s needs, some categories should be in all forensics toolkits. A solid toolset is at the core of any s uccessful digital forensics program.

Free forensic software downloads