EU Digital Forensics Tools Catalogue

Extension of the EVIDENCE Digital Forensics Tools Catalogue (EU FP7 Project 608185) Original: © ECTEG / EVIDENCE Consortium | This extension: © 2026 Ing. F. Weijers License: CC BY 4.0 | Attribution & License details

---

About

This repository maintains and extends the EVIDENCE Digital Forensics Tools Catalogue, originally created by ECTEG (European Cybercrime Training and Education Group) as part of the EU-funded EVIDENCE project (FP7 No. 608185).

The original catalogue at https://www.ecteg.eu/dft was discontinued on 01 January 2026. This independent continuation preserves and extends the dataset for the digital forensics community.

Thank you to the original authors, the EVIDENCE Consortium, ECTEG, and the European Commission for creating and funding this knowledge base.

---

What's New (Extended Edition)

	Original	This Edition
Total tools	~1533 (raw)	1567 (deduplicated, enriched)
New tools added	—	168 (AI forensics, OSINT, cloud, memory, malware RE)
Tags	—	153 unique tags, avg. 7/tool
Maintenance monitoring	—	Active / Stale / Abandoned / Legacy
Dead URL detection	—	222 flagged
License	Not specified	CC BY 4.0
Format	Web app (MySQL)	CSV + JSON (open, portable)

---

Statistics

Metric	Value
Total tools	1567
Categories	15
Open Source	348
Freeware	744
Commercial	453+
Actively maintained (GitHub/SF)	97
Dead URLs documented	222
Unique tags	153

Categories

Category	Tools
Computer Forensics	376
Anti Forensics	160
File Analysis	157
Live acquisition	130
Malware Forensics	120
Disk duplication	111
Mobile Forensics	84
Mobile device	78
Internet/Cloud	73
Network Forensics	65
Cross Analysis	59
Forensics/E-Discovery Toolkit	49
Network	43
Forensics Utilities	40
Memory Forensics	22

---

Repository Structure

dft-catalogue-download/
├── dft_tools_full.csv          ← Main database: 1553 tools (all fields)
├── categories/                 ← Per-category CSVs (15 files)
│   ├── computer_forensics.csv
│   ├── mobile_forensics.csv
│   └── ...
├── new_tools/                  ← Research CSVs (DFT-001 to DFT-012)
│   ├── DFT-001_osint_social_cloud.csv
│   ├── DFT-002_commercial_tools.csv
│   └── ...
├── website/                    ← Static web catalogue (deploy to any host)
│   ├── index.html
│   ├── tool.html
│   ├── about.html
│   ├── assets/
│   └── data/tools.json
├── parse_dft_to_csv.py         ← SQL dump → CSV parser
├── enrich_catalogue.py         ← Tag enrichment
├── build_catalogue.py          ← CSV → category files + stats
├── cleanup_catalogue.py        ← Dedup, normalize, flag dead URLs
├── version_monitor.py          ← GitHub/SourceForge maintenance check
├── validate_new_tools.py       ← Quality gate for new tools
├── merge_new_tools.py          ← Merge validated tools into main CSV
├── ATTRIBUTION.md              ← Full attribution & license details
└── LICENSE                     ← CC BY 4.0

---

CSV Fields

Field	Description
IdTool	Original tool ID from EVIDENCE DB
Tool	Tool name
Status	Published / Editor/Community
Process	Acquisition (AC) / Analysis (AN)
LicenseType	Open Source / Freeware / Commercial
OperatingSystem	Windows / Linux / Mac / Multi / Online / Hardware
Developer	Developer or organization
Url	Official URL
PrimaryCategory	Main category
CategoryPath	Full category path
Description	Tool description
DateInsert	Date added to catalogue
HasTestReport	Yes/No — NIST/DHS test report available
Features	Semi-structured feature list
Tags	Semicolon-separated tags (119 unique)
DeadURL	1 = URL unreachable (verified 2026)
MaintenanceStatus	Active / Stale / Abandoned / Legacy / Unknown

---

Usage

Quick start

git clone https://github.com/Pythonhaxx/dft-catalogue.git
cd dft-catalogue

Load in Python

import csv
with open('dft_tools_full.csv') as f:
    tools = list(csv.DictReader(f))

# Active open source tools only
active_oss = [t for t in tools
              if t['LicenseType'] == 'Open Source'
              and t['MaintenanceStatus'] == 'Active'
              and t['DeadURL'] == '0']

Run the web catalogue locally

cd website
python3 -m http.server 8080
# Open http://localhost:8080

Update tools.json after CSV changes

cd website
python3 generate_json.py

Run maintenance monitoring

python3 version_monitor.py
# Results: version_status.csv + maintenance_report.txt
# Uses cache: .version_cache.json (7-day TTL)
# Optional: add GitHub token to ~/.github_token for higher rate limits

---

Attribution

This work extends the EVIDENCE Digital Forensics Tools Catalogue:

• Project: EVIDENCE — Towards a European Framework for Digital Evidence
• EU Grant: FP7 Project No. 608185
• Original catalogue: https://www.ecteg.eu/dft
• Authors: ECTEG / EVIDENCE Project Consortium
• Funded by: European Commission, 7th Framework Programme (FP7)
• Original copyright: © ECTEG / EVIDENCE Consortium

See ATTRIBUTION.md for full details and citation guidance.

---

License

This extended edition is published under Creative Commons Attribution 4.0 International (CC BY 4.0).

You may freely use, share, and adapt this data — including for commercial purposes — as long as you give appropriate credit. See LICENSE for details.

Suggested citation:

EU Digital Forensics Tools Catalogue (extended edition, 2026)
Maintainer: Ing. F. Weijers, weijers@cyberprofis.de
Based on: EVIDENCE Project (EU FP7 608185) / ECTEG — https://www.ecteg.eu/dft
License: CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/

---

Disclaimer

This is an independent community project. It is not an official EU publication and is not affiliated with the European Commission, ECTEG, or the EVIDENCE Consortium. Mentioned solely for attribution as required by CC BY 4.0.

Tool information is for research and informational purposes only.

---

Donate

If this catalogue is useful for your research or work, consider supporting it:

https://paypal.me/IngWeijers