A curated collection of Digital Forensics & Incident Response (DFIR) tools used for forensic investigation, malware analysis, incident response, memory forensics, disk analysis, and triage.
This toolkit includes tools from my DFIR environment + recommended industry-standard DFIR tools.
- Overview
- Disk & File System Forensics
- Memory Forensics
- Malware Analysis
- Network Forensics
- Log & Registry Analysis
- Browser & Email Forensics
- Triage & Incident Response
- Data Recovery
- Hex Editors & Binary Tools
- Additional Recommended DFIR Tools
- Conclusion
This toolkit is designed for:
- Digital forensic investigations
- Malware and incident response
- Live system triage
- File, memory, registry, and network analysis
- DFIR learning and CTF challenges
Open-source forensic suite used to analyze partitions, recovered files, timestamps, and disk structures.
Category containing tools for examining disk images (E01, RAW, VHD), partitions, file carving, etc.
GUI forensic platform for analyzing digital media, recovering deleted files, and generating reports.
Used for creating forensic images and previewing disk contents without altering evidence.
May include Volatility, Volatility3, or Rekall for analyzing memory dumps.
Industry-standard RAM forensics tool.
Finds:
- Processes
- Injected code
- Network connections
- DLLs
- Malware in memory
Tools used to acquire RAM images from live systems.
General tools for analyzing malware behavior.
Static analysis of executables to reveal suspicious indicators.
Automatically identifies malware capabilities.
Debuggers for reverse engineering malware.
NSA’s reverse engineering suite for binary analysis.
Multi-purpose tool for decoding, deobfuscation, encryption, and data transformations.
Category for traffic analysis tools.
Most widely used tool for investigating PCAP files.
Command-line packet analyzer.
Generates metadata logs from network traffic (very useful for IR and timeline analysis).
Port and service scanning, OS fingerprinting, and vulnerability discovery.
Parses log files like Windows event logs, firewall logs, proxy logs, etc.
Registry parsing tools such as:
- RegRipper
- Registry Explorer
Includes:
- Autoruns – persistence detection
- Process Explorer – process investigation
- Procmon – event tracing
- TCPView – network connection monitoring
Tools for viewing:
- History
- Cookies
- Cache
- Autofill
- Download records
Supports PST, OST, MBOX, EML formats for email forensic investigations.
Extracts metadata (EXIF, GPS, timestamps) from:
- Images
- PDFs
- Videos
- Documents
Popular set of Windows forensic tools:
- KAPE
- Registry Explorer
- JumpList Explorer
- ShellBags Explorer
- USB Detective
Rapid incident response triage tool.
Tools that quickly scan systems for malicious files, processes, and persistence mechanisms.
Detects hidden or abnormal persistence across:
- Run keys
- Services
- Scheduled tasks
- WMI
Tools for restoring deleted partitions, lost files, and corrupt storage devices.
Most widely used open-source recovery utilities.
Hex editor used for:
- Disk sector analysis
- Binary inspection
- File carving
- Manipulating raw bytes
- Cellebrite UFED
- Magnet AXIOM Mobile
- log2timeline (Plaso)
- Timesketch
- OSQuery
- Auditd
- chkrootkit
- AWS IR tools
- Azure Sentinel playbooks
This DFIR toolkit provides a wide coverage of tools for:
✔ Disk forensics
✔ Memory forensics
✔ Network investigation
✔ Malware analysis
✔ Incident response
✔ Registry & log analysis
✔ USB & browser forensics
✔ Data recovery
It is suitable for both professional IR work and DFIR learning.