# data[].attributes.attachment_link.title
Software | Digital Forensics | Computer Forensics | Blog

# data[].attributes.attachment_link.description
Computer Forensics Cell Phone Forensics E-Discovery Automotive Forensics Audio Video Forensics Forensics Accounting Deceased Persons Data

# data[].attributes.body
Update Jan 23, 2019

# data[].attributes.attachment_link.readable_text
Here are 20 of the best free tools that will help you conduct a digital forensic investigation. Whether it's for an internal human resources case, an investigation into unauthorized access to a server, or if you just want to learn a new skill, these suites and utilities will help you conduct memory forensic analysis, hard drive forensic analysis, forensic image exploration, forensic imaging and mobile forensics. As such, they all provide the ability to bring back in-depth information about what's "under the hood" of a system.

This is by no means an extensive list and may not cover everything you need for your investigation. You might also need additional utilities such a file viewers, hash generators, and text editors - checkout 101 Free Admin Tools for some of these.

My articles on Top 10 Free Troubleshooting Tools for SysAdmins, Top 20 Free Network Monitoring and Analysis Tools for Sys Admins and Top 20 Free File Management Tools for Sys Admins might also come in handy since they contain a bunch of tools that can be used for Digital Forensic Investigations (e.g. BackTrack and the SysInternals Suite or the NirSoft Suite of tools).

Even if you may have heard of some of these tools before, I'm confident that you'll find a gem or two amongst this list.

The SANS Investigative Forensic Toolkit (SIFT) is an Ubuntu based Live CD which includes all the tools you need to conduct an in-depth forensic or incident response investigation. It supports analysis of Expert Witness Format (E01), Advanced Forensic Format (AFF), and RAW (dd) evidence formats. SIFT includes tools such as log2timeline for generating a timeline from system logs, Scalpel for data file carving, Rifiuti for examining the recycle bin, and lots more.

When you first boot into the SIFT environment, I suggest you explore the documentation on the desktop to help you become accustomed to what tools are available and how to use them. There is also a good explanation of where to find evidence on a system. Use the top menu bar to open a tool, or launch it manually from a terminal window.

ProDiscover Basic is a simple digital forensic investigation tool that allows you to image, analyse and report on evidence found on a drive. Once you add a forensic image you can view the data by content or by looking at the clusters that hold the data. You can also search for data using the Search node based on the criteria you specify.

When you launch ProDiscover Basic you first need to create or load a project and add evidence from the 'Add' node. You can then use the 'Content View' or 'Cluster View' nodes to analyse the data and the Tools menu to perform actions against the data. Click the 'Report' node to view important information about the project.

Volatility is a memory forensics framework for incident response and malware analysis that allows you to extract digital artefacts from volatile memory (RAM) dumps. Using Volatility you can extract information about running processes, open network sockets and network connections, DLLs loaded for each process, cached registry hives, process IDs, and more.

If you are using the standalone Windows executable version of Volatility, simply place volatility-2.1.standalone.exe into a folder and open a command prompt window. From the command prompt, navigate to the location of the executable file and type "volatility-2.1.standalone.exe -f <FILENAME> -profile=<PROFILENAME> <PLUGINNAME>" without quotes - FILENAME would be the name of the memory dump file you wish to analyse, PROFILENAME would be the machine the memory dump was taken on and PLUGINNAME would be the name of the plugin you wish to use to extract information.

Note: In the example above I am using the 'connscan' plugin to search the physical memory dump for TCP connection information.

The Sleuth Kit is an open source digital forensics toolkit that can be used to perform in-depth analysis of various file systems. Autopsy is essentially a GUI that sits on top of The Sleuth Kit. It comes with features like Timeline Analysis, Hash Filtering, File System Analysis and Keyword Searching out of the box, with the ability to add other modules for extended functionality.

Note: You can use The Sleuth Kit if you are running a Linux box and Autopsy if you are running a Windows box.

When you launch Autopsy, you can choose to create a new case or load an existing one. If you choose to create a new case you will need to load a forensic image or a local disk to start your analysis. Once the analysis process is complete, use the nodes on the left hand pane to choose which results to view.

FTK Imager is a data preview and imaging tool that allows you to examine files and folders on local hard drives, network drives, CDs/DVDs, and review the content of forensic images or memory dumps. Using FTK Imager you can also create SHA1 or MD5 hashes of files, export files and folders from forensic images to disk, review and recover files that were deleted from the Recycle Bin (providing that their data blocks haven't been overwritten), and mount a forensic image to view its contents in Windows Explorer.

Note: There is a portable version of FTK Imager that will allow you to run it from a USB disk.

When you launch FTK Imager, go to 'File > Add Evidence Item...' to load a piece of evidence for review. To create a forensic image, go to 'File > Create Disk Image...' and choose which source you wish to forensically image.

06 Linux 'dd'

dd comes by default on the majority of Linux distributions available today (e.g. Ubuntu, Fedora). This tool can be used for various digital forensic tasks such as forensically wiping a drive (zero-ing out a drive) and creating a raw image of a drive.

Note: dd is a very powerful tool that can have devastating effects if not used with care. It is recommended that you experiment in a safe environment before using this tool in the real world.

Tip: A modified version of dd is available from http://sourceforge.net/projects/dc3dd/ - dc3dd includes additional features that were added specifically for digital forensic acquisition tasks.

To use dd, simply open a terminal window and type dd followed by a set of command parameters (which command parameters will obviously depend on what you want to do). The basic dd syntax for forensically wiping a drive is:

dd if=/dev/zero of=/dev/sdb1 bs=1024
where if = input file, of = output file, bs = byte size

Note: Replace /dev/sdb1 with the drive name of the drive you want to forensically wipe and 1024 with the size of the byte blocks you want to write out.

The basic dd syntax for creating a forensic image of a drive is:

dd if=/dev/sdb1 of=/home/andrew/newimage.dd bs=512 conv=noerror,sync

where if = input file (or in this case drive), of = output file, bs = byte size, conv = conversion options

Tip: For additional usage info, from a terminal window, type "man dd" without quotes to bring up the help manual for the dd command.

CAINE (Computer Aided INvestigative Environment) is Linux Live CD that contains a wealth of digital forensic tools. Features include a user-friendly GUI, semi-automated report creation and tools for Mobile Forensics, Network Forensics, Data Recovery and more.

When you boot into the CAINE Linux environment, you can launch the digital forensic tools from the CAINE interface (shortcut on the desktop) or from each tool's shortcut in the 'Forensic Tools' folder on the applications menu bar.

If you are investigating a case that requires you to gather evidence from a mobile phone to support your case, Oxygen Forensics Suite (Standard Edition) is a tool that will help you achieve this. Features include the ability to gather Device Information (Manufacturer, OS Platform, IMEI, Serial Number, etc.), Contacts, Messages (Emails, SMS, MMS, etc.) and recovery of deleted messages, Call Logs, and Calendar and Task information. It also comes with a file browser which allows you to access and analyse user photos, videos, documents and device databases.

When you launch Oxygen Forensic Suite, hit the 'Connect new device' button on the top menu bar to launch the Oxygen Forensic Extractor wizard that guides you through selecting the device and type of information you wish to extract.

Free Hex Editor Neo is a basic hex editor that was designed to handle very large files. While a lot of the additional features are found in the commercial versions of Hex Editor Neo, I find this tool useful for loading large files (e.g. database files or forensic images) and performing actions such as manual data carving, low-level file editing, information gathering, or searching for hidden data.

Use 'File > Open' to load a file into Hex Editor Neo. The data will appear in the middle window where you can begin to navigate through the hex manually or press CTRL + F to run a search.

bulk_extractor is a computer forensics tool that scans a disk image, file, or directory of files and extracts information such as credit card numbers, domains, e-mail addresses, URLs, and ZIP files. The extracted information is output to a series of text files (which can be reviewed manually or analysed using other forensics tools or scripts).

Tip: Within the output text files you will find entries for data that resemble a credit card number, e-mail address, domain name, etc. You will also see a decimal value in the first column of the text file that, when converted to hex, can be used as the pointer on disk where the entry was found (i.e. if you were analysing the disk manually using a hex editor for example, you would jump to this hexadecimal value to view the data).

Bulk_extractor comes as a command-line tool or a GUI tool. In the example above I set the bulk extractor tool to extract information from a forensics image I took earlier and output the results to a folder called "BE_Output". The results can then be viewed in the Bulk Extractor Viewer and the output text files mentioned above.

DEFT is another Linux Live CD which bundles some of the most popular free and open source computer forensic tools available. It aims to help with Incident Response, Cyber Intelligence and Computer Forensics scenarios. Amongst others, it contains tools for Mobile Forensics, Network Forensics, Data Recovery, and Hashing.

When you boot using DEFT, you are asked whether you wish to load the live environment or install DEFT to disk. If you load the live environment you can use the shortcuts on the application menu bar to launch the required tools.

Xplico is an open source Network Forensic Analysis Tool (NFAT) that aims to extract applications data from internet traffic (e.g. Xplico can extract an e-mail message from POP, IMAP or SMTP traffic). Features include support for a multitude of protocols (e.g. HTTP, SIP, IMAP, TCP, UDP), TCP reassembly, and the ability to output data to a MySQL or SQLite database, amongst others.

Once you've installed Xplico, access the web interface by navigating to http://<IPADDRESS>:9876 and logging in with a normal user account. The first thing you need to do is create a case and add a new session. When you create a new session you can either load a PCAP file (acquired from Wireshark for example) or start a live capture. Once the session has finished decoding, use the navigation menu on the left hand side to view the results.

I briefly touched on LastActivityView when pointing out the NirSoft suite of tools in my Top 10 Free System Troubleshooting Tools for SysAdmins article. LastActivityView allows you to view what actions were taken by a user and what events occurred on the machine. Any activities such as running an executable file, opening a file/folder from Explorer, an application or system crash or a user performing a software installation will be logged. The information can be exported to a CSV / XML / HTML file. This tool is useful when you need to prove that a user (or account) performed an action he or she said they didn't.

When you launch LastActivityView, it will immediately start displaying a list of actions taken on the machine it is being run on. Sort by action time or use the search button to start investigating what actions were taken on the machine.

DSi USB Write Blocker is a software-based write blocker that prevents write access to USB devices. This is important in an investigation to prevent modifying the metadata or timestamps and invalidating the evidence.

When you run DSi USB Write Blocker, it brings up a window that allows you to enable or disable the USB Write Blocker. Once you make changes and exit the application, you can keep an eye on the status from the padlock icon in the taskbar. When performing an analysis of a USB drive, enable the USB Write Blocker first and then plug the USB drive in.

Note: If you are looking for a command line alternative USB Write Blocker, check out 'USB Write Blocker for ALL Windows': http://sourceforge.net/projects/usbwriteblockerforwindows8/

RedLine offers the ability to perform memory and file analysis of a specific host. It collects information about running processes and drivers from memory, and gathers file system metadata, registry data, event logs, network information, services, tasks, and Internet history to help build an overall threat assessment profile.

When you launch RedLine, you will be given a choice to Collect Data or Analyze Data. Unless you already have a memory dump file available, you'll need to create a collector to gather data from the machine and let that process run through to completion. Once you have a memory dump file to hand you can begin your analysis.

PlainSight is a Live CD based on Knoppix (a Linux distribution) that allows you to perform digital forensic tasks such as viewing internet histories, data carving, USB device usage information gathering, examining physical memory dumps, extracting password hashes, and more.

When you boot into PlainSight, a window pops up asking you to select whether you want to perform a scan, load a file or run the wizard. Enter a selection to begin the data extraction and analysis process.

HxD is one of my personal favourites. It is a user-friendly hex editor that allows you to perform low-level editing and modifying of a raw disk or main memory (RAM). HxD was designed with easy-of-use and performance in mind and can handle large files without issue. Features include searching and replacing, exporting, checksums/digests, an in-built file shredder, concatenation or splitting of files, generation of statistics and more.

From the HxD interface start your analysis by opening a file from 'File > Open', loading a disk from 'Extras > Open disk...' or loading a RAM process from 'Extras > Open RAM...'

HELIX3 is a Live CD based on Linux that was built to be used in Incident Response, Computer Forensics and E-Discovery scenarios. It is packed with a bunch of open source tools ranging from hex editors to data carving software to password cracking utilities, and more.

Note: The HELIX3 version you need is 2009R1. This version was the last free version available before HELIX was taken over by a commercial vendor. HELIX3 2009R1 is still valid today and makes for a useful addition to your digital forensics toolkit.

When you boot using HELIX3, you are asked whether you want to load the GUI environment or install HELIX3 to disk. If you choose to load the GUI environment directly (recommended), a Linux-based screen will appear giving you the option to run the graphical version of the bundled tools.

Paladin Forensic Suite is a Live CD based on Ubuntu that is packed with wealth of open source forensic tools. The 80+ tools found on this Live CD are organized into over 25 categories including Imaging Tools, Malware Analysis, Social Media Analysis, Hashing Tools, etc.

After you boot Paladin Forensic Suite, navigate to the App Menu or click on one of the icons in the taskbar to get started.

Note: A handy Quick Start Guide for Paladin Forensic Suite is available to view or download from the Paladin website as well as the taskbar within Paladin itself.

USB Historian parses USB information, primarily from the Windows registry, to give you a list of all USB drives that were plugged into the machine. It displays information such as the name of the USB drive, the serial number, when it was mounted and by which user account. This information can be very useful when you're dealing with an investigation whereby you need to understand if data was stolen, moved or accessed.

When you launch USB Historian, click the '+' icon on the top menu to launch the data parse wizard. Select which method you want to parse data from (Drive Letter, Windows and Users Folder, or Individual Hives/Files) and then select the respective data to parse. Once complete you will see information similar to that shown in the above image.

# data[].attributes.attachment_link.title
Top 20 Free Digital Forensic Investigation Tools for SysAdmins

# data[].attributes.attachment_link.description
Here are 20 of the best free tools that will help you conduct a digital forensic investigation. Whether it's for an internal human resources case, an investigation into unauthorized access to a server, or if you just want to learn a new skill, these suites a perfect place to start.

# data[].attributes.attachment_link.title
WatchDocumentaries.com | Watch Free Documentaries Online

# data[].attributes.attachment_link.description
Collection of the world's greatest full-length documentaries. All films are free to watch and enjoy online. Embrace the knowledge!

# data[].attributes.attachment_link.description
Lecture Notes : School of Mechatronic Engineering : Semester 1 Sidang Akademik 2011/2012 : ENT 471 AUTOMATION : MAKMAL

# data[].attributes.attachment_link.description
Lecture Notes : School of Mechatronic Engineering : Semester 1 Sidang Akademik 2011/2012 : ENT 471 AUTOMATION : KULIAH

# data[].attributes.attachment_link.description
Lecture Notes : School of Mechatronic Engineering : Semester 1 Sidang Akademik 2011/2012

# data[].attributes.attachment_link.description
Lecture Notes : School of Mechatronic Engineering : Semester 1 Sidang Akademik 2011/2012

# data[].attributes.attachment_link.description
Lecture Notes : School of Mechatronic Engineering

# data[].attributes.attachment_link.readable_text
(Image credit: Gorodenkoff / Shutterstock)

Free screen recorders have come a long way in recent years, and there are now some very impressive tools available that can capture everything that's happening on your screen completely free, and without any frustrating limitations.

The best free screen recorder is . A remarkable program with a feature set that rivals those of the more premium tools, it can not only record everything happening on your desktop, but also capture footage from your webcam and use it for picture-in-picture video, and even record audio from a microphone. It also gives you the option to save the results in a format of your choice, or stream them via the service of your choice.

Still, while OBS Studio is certainly an ideal choice for professionals and gamers alike, there are other capable options that are worth looking into. If you only need to capture a few minutes of footage, a more straightforward tool might be all you need.

So, we've rounded up the very best free screen recorders for all projects and levels of experience. Whether you're making a software tutorial for your YouTube channel, recording a Let's Play video, or capturing a video call, there's something here that'll fit the bill.

Some of these screen recorders even offer an option to save directly online. Check out a list of the best cloud storage providers out there.

The best screen recorder right now is: Flashback ProFlashback Pro offers a much more comprehensive set of tools than the free Flashback Express version listed below, including the ability to edit video and audio frame by frame, add picture-in-picture video and annotations. It's not free like the options below, but if you need something for professional use on a regular basis then it might be worth the investment. View Deal

If you're a keen gamer, OBS Studio is easily the best free screen recorder for you. Unlike the hugely popular FRAPS (which only lets you record for 30 seconds at a stretch unless you've bought a license, and applies a watermark to the resulting footage), OBS Studio is open source, and completely free to use without restrictions.

OBS Studio supports both streaming and recording in high definition, with no restrictions on the number or length of your creations. You can stream live to Twitch or YouTube gaming, save projects and come back to them later, or encode your footage in FLV format and save it locally.

Because OBS Studio can record directly from your graphics card, it's able to capture games running in full-screen mode (many other screen recorders can only record if the game is windowed), with customizable hotkeys to control the recording. OBS Studio can also make full use of multi-core CPUs for improved performance, and can record at 60FPS (or even higher).

It might take a little while to set it up exactly how you want, but OBS Studio is by far the best and most powerful screen recorder for gamers.

OBS Studio is our favorite free screen recorder, but Flashback Express comes an extremely close second. Despite being a free version of a paid program, FlashBack Express won't put ugly watermarks over your recordings or impose time limits, and it's packed with features and tools that rival many premium programs. Its interface is less intimidating than OBS Studio, so if you've never used a screen recorder before, it's an excellent choice.

You can record from your whole screen, a window, a selected area, or a webcam. Once you've finished, your recording will appear in a simple editor, where you can crop and trim it to suit your needs, then export it to YouTube, an FTP server, or your PC.

That's all fairly standard fare for a free screen recorder, but take a minute to dive into Flashback's advanced options and you'll find a wealth of thoughtfully designed settings that will make your desktop recordings look truly professional. The recorder can automatically obscure passwords entered on screen, replace your silly wallpaper with a plain one, hide messy desktop icons, and highlight your mouse pointer to make it easier to follow. There's also a dedicated gaming mode that lets you define the number of frames recorded per second.

There's no limit on the length of your recordings unless you choose to set one, which can be useful if there's a chance you might accidentally leave the recorder running. You can also choose to break long recordings up into chunks - a brilliant touch that helps you avoid creating huge, unwieldy files. Your recordings won't be watermarked, either.

Following a recent update, Flashback Express can export in WMV, AVI and MP4 formats, eliminating the need for a separate video converter, and it no longer requires a free license key for activation - just install the software and you're ready to start recording.

Developer Blueberry Software has also released a free screen recorder designed specifically for games - FBX. This recorder captures HD in-game footage, with hardware acceleration for AMD and Nvidia cards, and Intel CPUs.

If you're thinking about upgrading to FlashBack Pro, Blueberry software is offering TechRadar readers an exclusive 25% discount.
Read our full

(Image credit: Apowersoft; Shutterstock)

Flashback Express review
If you want to record a presentation, software demonstration or tutorial, give Apowersoft Free Online Screen Recorder a try. This browser-based tool may not be suitable for games, but it's the best free screen recorder for any other tasks.

The first time you use Apowersoft Free Online Screen Recorder, you'll be prompted to download a small launcher application. You'll then be provided with a control bar packed with more options than you'll find in most desktop screen recording software. You can capture footage from your desktop or a webcam, and record audio from your PC, microphone, both or neither.

You can record the whole screen, select an area manually or choose one of the preset resolutions - ideal if you're recording a clip for YouTube, for example, and don't want to use a separate video editor to resize it later.

Apowersoft Free Online Screen Recorder also offers customizable keyboard shortcuts for speed and convenience. You can choose whether or not to include the cursor in the recording and take your pick from a range of output formats including MP4, WMV, AVI, MOV and many more. You can even add annotations during the recording.

Once you're done, you can save the recording as a video file or GIF, upload it directly to YouTube or Vimeo, or send it to Google Drive or Dropbox. You can also edit the clip. Selecting this option will download an additional component - Apowersoft Video Editor - which lets you make simple adjustments before exporting your video in your preferred format. A truly exceptional tool.
Read our full Apowersoft Free Online Screen Recorder review
Note that the 'Download desktop version' button links to a program called Apowersoft Screen Recorder Pro. This is a trial version of a premium application, and is more limited than Online Screen Recorder.

Debut Video Capture is a new addition to our roundup of free screen recorders, and although its slightly dated design does it few favors, it's an extremely powerful program that can do much more than just capture what's happening on your PC monitor.

In addition to basic screen recording (with no time limits or watermarks), Debut Video Capture can also record footage from external devices, including webcams and security cameras. It can even record on a regular schedule, which means it can become the main hub of a home security system. Not too shabby for a program that's totally free for personal use.
Read our full

(Image credit: ShareX Team; Shutterstock)

Debut Video Capture review
There are no post-production editing tools, but you can apply filters and add your own captions and watermarks before you begin recording. There's no option for exporting videos directly to YouTube or Facebook, but they can be saved in all the main formats, including MP4, MOV and AVI (to name just three).

Debut Video Capture is currently in public beta, so we look forward to seeing the final release version with a lick of extra polish soon.

ShareX is an open source app for capturing still screen grabs and recording videos. There are no watermarks or time limits to worry about, but the interface isn't the most intuitive in the world so you'll be best off using keyboard shortcuts. For quick reference, you can start a recording by tapping Shift + Print Screen, and stop it again using Ctrl + Shift + Print Screen.

You can also use this free screen recorder to save your capture as a GIF rather than a video file, which can be extremely useful for sharing on forums and social media.

Not only is ShareX among the best free screen recorders, but it can also capture an entire scrolling webpage, capture and identify text via OCR, and even capture your screen according to a schedule.

Another of its best features is the ability to send your captured grabs and videos straight to a file-sharing or social media site. There's a vast array of options, which you can check out on the project's site.

Unfortunately, ShareX doesn't support taking screen grabs or recordings from games running in full-screen mode. Other than that, it's a superb screen recorder that will serve you extremely well.

Screencast-O-Matic is another browser-based free screen recorder, and a very capable one at that. Recordings are limited to 15 minutes in length, but you can record as many clips as you like, zoom while recording, trim your recorded clips, add captions, save them to your desktop, YouTube or the cloud, share a video link, or add one of 30 royalty-free music tracks

Hit 'Start recording for free', followed by 'Launch free recorder'. As with Apowersoft Free Online Screen Recorder, you'll be prompted to download and install a small web launcher, after which the screen recorder will launch. Prepare your screen and adjust the size of the recording window to suit your needs (it can record the whole screen or just a selected area), then hit the red button. You can capture audio from your PC or a microphone, and record footage from your screen, a webcam or both.

Upgrading to a Deluxe account gives you extra features including scripted recordings, drawing and annotations, a video editor, and (perhaps most usefully) the ability to generate captions automatically with text-to-speech. That's an impressive set of tools for $1.65 (about £1, AU$2.50) per month, but the free version of Screencast-O-Matic has a lot to offer as well.

The only real downside is that your recordings will be watermarked unless you upgrade, but if that's not an issue then this free screen recorder is well worth a look.

# data[].attributes.attachment_link.title
The best free screen recorders 2021: free software to capture all the action

# data[].attributes.attachment_link.description
(Image credit: Gorodenkoff / Shutterstock) Free screen recorders have come a long way in recent years, and there are now some very impressive tools available that can capture everything that's happening on your screen completely free, and without any frustrating limitations. The best free screen recorder is .

# data[].attributes.attachment_link.title
Digital Forensics Lab Setup | iSAFER | UMass Lowell

# data[].attributes.attachment_link.readable_text
Creating a digital forensic laboratory is a responsible step. The effectiveness of the laboratory depends on what software, hardware and equipment will be purchased.

DFC specialists took part in the creation and upgrade of several digital forensic laboratories owned by state organizations and private entities and today they will share their tips and tricks.

Choosing a workstation configuration is an important step. The effectiveness of digital examiners depends on the way the workstation is configured.

However, we want to pay special attention to one point: the workstation should work as quietly as possible. Imagine an open space where several powerful computers are installed, each of which makes a noise like a server. The employees' headache and poor health are guaranteed. Silent workstation performance is achieved by using low-noise fans and passive cooling systems.

Do not use top hardware. The idea to buy the most expensive processor, memory, motherboard for your new workstation is not the best one. We had many problems with the workstation in which similar components were used.

In our opinion, this configuration is optimal today:

OS: Windows 10 Pro 64-bit

CPU (2): E5-2660 v4 (14 core)

RAM: 64 GB DDR-42133 ECC

OS Drive: 1 TB SSD

Temp/Cache/DB Drive: 256 GB SSD

Data Drive: 8 TB 7200rpm

RAID Drives: 5×4 TB 7200rpm

Video Card: GeForce GTX 1080

We recommend to use two or more monitors for each workstation.

The most effective work is achieved when a digital examiner uses two workstations in its work.

Use NET Storages to store cases, forensic images, etc. NET Storages with a volume of 100-150 TB proved to be quite effective.

Use 10Gbit Net Cards. They will allow you to transfer data from the workstation to NET Storages quickly.

A Tableau Write Blockers Kit

It's a good idea to have as more different forensic software in the digital laboratory. This will allow a forensic examiner to make cases as quickly and efficiently as possible. Also, this makes it possible to recheck the results of the research effectively.

However, if you have a limited budget, we recommend buying this software:

Windows 10 Pro

Office 365

Antivirus software

X-ways Forensic

AXIOM (Magnet Forensics)

The rest of the tools can be purchased as the laboratory develops.

Also, a lot of research can be done using freeware tools. Sometimes these tools outperform functionality of commercial tools.

If you create a digital forensic laboratory in a government organization, for example in the police department, then most likely they have their own case management software and then your task is just to add a new laboratory to the network of existing ones.

In other cases, you can use free and chargeable CRM systems. Besides, some CRM systems can be adapted to your management needs.

We recommend Kirjuri (Kirjuri is a web application for managing cases and physical forensic evidence items.) and Lima Forensic Case Management of all the specialized tools.

We recommend using a separate workstation for the production of video forensics cases. We recommend using the following forensic tools:

DVR Examiner

Amped FIVE

Elecard

Very good results of recovering deleted videos can be obtained using X-ways Forensic. We have written about this tool above.

We recommend using a separate workstation to carry out mobile forensics research.

There are a lot of tools for mobile forensics. That is why it is difficult for a beginner to understand what they need to carry out this research effectively. We recommend using the following mobile forensic tools:

UFED 4PC (with CHINEX, UFED Camera Kit)

Cellebrute UFED Touch

Cellebryte cables and adapters

Oxygen Forensics DETECTIVE

XRY

Elcomsoft Mobile Forensic Bundle

We recommend using SР Flash tool to retrieve data from MTK based phones.

A Faraday Box (Ramsey)

We recommend using the following tools for Cloud forensics:

UFED Cloud Analyzer

Oxygen Forensics DETECTIVE

Elcomsoft Cloud eXplorer

We recommend using flashers for JTAG research:

Easy Z3x JTAG BOX

Octoplus Box

Samsung anyway S101

For Chip-off we recommend using:

VISUAL NAND RECONSTRUCTOR (STARTER KIT, Rusolut)

SMARTPHONE KIT (Rusolut)

CHINESE SMARTPHONE KIT (Rusolut)

NuProg-E UFS/EMMC Programmer

IN-UFS-Socket BGA Opentop

N-UFS-065-BGA095-115130-02O BGA Opentop

N-UFS-050-FBGA153-115130-02O BGA Opentop

We recommend using Weller WHA 300 Hot Air Reworking Station or Ersa HR100 Hybrid Rework system for disordering chips.

We recommend using a separate workstation for the production of Data recovery. You will need special hardware and tools for data recovery:

PC-3000 Express Professional System (Acelab)

Data Extractor Express (Acelab)

PC-3000 Flash (Acelab)

Many people believe that it is enough to buy ordinary office desks and chairs to equip a digital forensic lab. However, it is not so. Tables must have abrasion resistant coatings. We recommend the use of special laboratory tables.

Office chairs should be as convenient as possible. We recommend using not ordinary office chairs but gaming chairs.

The table where the electronic equipment is assembled and disassembled should be equipped with an antistatic mat and an antistatic bracelet.

Happy forensicating!

About the authors
Oleg Skulkin, GCFA, MCFE, ACE, is a DFIR enthusional (enthusiast + professional), Windows Forensics Cookbook and Practical Mobile Forensics co-author.

Igor Mikhaylov, MCFE, EnCE, ACE, OSFCE, is a digital forensic examiner with more than 20 years of experience and Mobile Forensics Cookbook author.

# data[].attributes.attachment_link.title
Creating a digital forensic laboratory: Tips and Tricks

# data[].attributes.attachment_link.description
Creating a digital forensic laboratory is a responsible step. The effectiveness of the laboratory depends on what software, hardware and equipment will be purchased. DFC specialists took part in the creation and upgrade of several digital forensic laboratories owned by state organizations and private entities and today they will share their tips and tricks.

# data[].attributes.attachment_link.readable_text
WSC Awarded First National Science Foundation Grant

WILLISTON, N.D. - Williston State College has been awarded a three-year, $225,000 National Science Foundation (NSF) grant for its Petroleum, Automation, and Information Technology (IT) programs to produce more qualified technicians educated in automation to meet growing industry needs.

The NSF is an independent federal agency created by Congress in 1950 to promote the progress of science; to advance the national health, prosperity and welfare; and to secure the national defense. The NSF supports fundamental research and education in all the non-medical fields of science and engineering.

WSC's NSF grant is funded by the NSF's Advanced Technological Education (ATE) program. The goal of the ATE program is to promote exemplary improvement in the way technicians are educated and to provide trained technicians.

As a result of the NSF ATE funding, WSC will diversify education for its students with professional development opportunities, ensuring Amatrol equipment is relevant and up-to-date, and consultation from a mentoring institution.

"We continue to see a significant influx of industry coming in and targeting automation, whether that be various energy companies, manufacturing, or agriculture," explained Ken Quamme, Professor of Information Technology at WSC. "All of these industries will need trained technicians and blending automation, petroleum, and IT is about preparing future technicians to handle future vulnerabilities."

In 2017, WSC was accepted into the NSF Mentor-Connect Program, an outreach initiative that provides leadership development for the NSF ATE Program. Chosen from 29 schools representing 22 states, WSC worked with Illinois Valley Community College's (IVCC) Jim Gibson and University of Wisconsin - Madison's Lori Scroggs, the grant's external reviewer, over a 10-month period to draft an NSF ATE grant proposal that resulted in the current award.

Jim Gibson, Electronics Program Coordinator at IVCC, assisted WSC throughout the drafting process and visited in January to meet with Quamme and Alex Kovalev, WSC's Petroleum Technology instructor.

An Amatrol expert with extensive international industry experience in automaton & controls and instrumentation, Gibson demonstrated how the same Amatrol equipment used at IVCC and in industry can be used at WSC. Amatrol designs, develops, and manufactures technical learning systems and other training equipment used in education and industry.

"It is always good to have another set of eyes to see how someone else is implementing the same tools," said Gibson. "We have the same Amatrol equipment at IVCC and it is very good because it is real world."

"For students going into automation, they need to have the fundamentals in electrical maintenance down," explained Gibson. "An understanding of AC/DC, motor controls, programmable logic controllers, and instrumentation will result in a good foundation for other programs as well."

With Gibson's guidance, Kovalev expanded his working knowledge of automation and has begun the mapping and blending process with Quamme of the IT, Petroleum, and Automation curricula.

"Automation is an inevitable component wherever you go," explained Kovalev. "While the first thing that might pop into your mind when thinking of an oil well is heavy piping and metal fittings, it's not just that. For any hazardous environments, oil companies will work at reducing a human presence and therefore liability, and loss of life and equipment. This is where automation kicks in, with machines doing the dangerous jobs. In the future, we will probably see fully automated drilling rigs."

"We as instructors are excited for this grant and know students are too because they benefit the most," said Quamme. "Alex is already brainstorming another grant, again in partnership with IVCC, so we can offer even more."

WSC is looking at another Amatrol module to do training with cyber security within automation.

"Everything is fluid and this grant will help us adjust our curriculum to industry's current needs and to provide a good springboard for students that will open doors to fields across the board," added Kovalev.

"The only constant we have is change," stated Gibson. "Just as students need a solid educational foundation and must learn to be flexible, so too do institutions in recognizing and meeting changing industry needs."

For more information on the NSF ATE grant, or the IT and Petroleum programs at WSC, please contact either Ken Quamme. Professor of Information Technology at 701.774.4207 or ken.quamme@willistonstate.edu or Alex Kovalev, Petroleum Technology Instructor at 701.774.4285 or alexey.kovalev@willistonstate.edu.

For more information on WSC please visit www.willistonstate.edu, call 1.888.863.9455, or stop by 1410 University Avenue, Williston, ND.

# data[].attributes.attachment_link.title
WSC Awarded First National Science Foundation Grant

# data[].attributes.attachment_link.description
WILLISTON, N.D. - Williston State College has been awarded a three-year, $225,000 National Science Foundation (NSF) grant for its Petroleum, Automation, and Information Technology (IT) programs to produce more qualified technicians educated in automation to meet growing industry needs.

# data[].attributes.attachment_link.title
ubivent | virtual events, online fairs and virtual conferences

# data[].attributes.attachment_link.description
ubivent is among the world's leading virtual event specialists and offers services for virtual fairs, webinars, online career fairs, virtual customer events, online trade shows, virtual kick off meetings, online academies, and virtual conferences.

# data[].attributes.attachment_link.keywords[]
virtual trade show software website online exhibit booth customize

# data[].attributes.attachment_link.description
Manage a 3D virtual trade show on your website for less than $300. Showcase your exhibitors with custom graphics and strategic booth positions within the virtual exhibit hall space that is open all year.

# data[].attributes.attachment_link.title
Live Cyber Attack Threat Map | Check Point Software

# data[].attributes.attachment_link.description
Check Point's Live Cyber Attack Threat Map provides real-time tracking of cyber attacks as they're launched around the world.

# data[].attributes.attachment_link.description
Idaho SkillStack® was funded by a grant awarded by the U.S. Department of Labor's Employment and Training Administration. The solution was created by the Idaho Career & Technical Education and does not necessarily reflect the official position of the U.S. Department of Labor.

# data[].attributes.attachment_link.description
Data recovery software for all types of media, ranging from optical (CD, DVD, BD) to Hard Drives, USB sticks, floppies etc. It recovers all types of files, both via a wide range of internally supported file systems, UDF, ISO9660, Joliet, FAT (12-32), ExFAT, NTFS, EXT, MFS, HFS(+) etc., as well as via full surface scanning or data carving.

# data[].attributes.attachment_link.description
Download Kickass Undelete for free. A free, open source file recovery tool for Windows. Kickass Undelete is a free, fully featured, file recovery tool for Windows. Accidentally deleted a file?

# data[].attributes.attachment_link.description
Data recovery software for all types of media, ranging from optical (CD, DVD, BD) to Hard Drives, USB sticks, floppies etc. It recovers all types of files, both via a wide range of internally supported file systems, UDF, ISO9660, Joliet, FAT (12-32), ExFAT, NTFS, EXT, MFS, HFS(+) etc., as well as via full surface scanning or data carving.

# data[].attributes.attachment_link.description
Download Kickass Undelete for free. A free, open source file recovery tool for Windows. Kickass Undelete is a free, fully featured, file recovery tool for Windows. Accidentally deleted a file?

# data[].attributes.attachment_link.description
Download FreeRecover for free. FreeRecover is a free file recovery program for NTFS drives. It allows you to search though and preview deleted files to find lost data.

# data[].attributes.attachment_link.description
Decrypt the system drive (openSystem menu in TrueCrypt and select Permanently Decrypt System Drive). If you want to encrypt the drive by BitLocker before decryption, disable Trusted Platform Module first and do not decrypt the drive now.

# data[].attributes.attachment_link.description
Professional data recovery software for Windows, Mac and Linux OS. Free demo and recovered files preview. Damaged RAID reconstruction and recovery over Network and Internet.

# data[].attributes.attachment_link.title
Computer Forensics Services by Experts - Digital Forensics Corporation

# data[].attributes.attachment_link.description
Our computer forensics experts provide the forensic services you need. Certified fraud and digital forensic examiners can work on-site or remotely to preserve your digital evidence, provide computer forensic analysis, and document forensic evidence

# data[].attributes.attachment_link.readable_text
Computer forensics is a very important branch of computer science in relation to computer and Internet related crimes. Earlier, computers were only used to produce data but now it has expanded to all devices related to digital data. The goal of Computer forensics is to perform crime investigations by using evidence from digital data to find who was the responsible for that particular crime.

For better research and investigation, developers have created many computer forensics tools. Police departments and investigation agencies select the tools based on various factors including budget and available experts on the team.

These computer forensics tools can also be classified into various categories:

Disk and data capture tools

File viewers

File analysis tools

Registry analysis tools

Internet analysis tools

Email analysis tools

Mobile devices analysis tools

Mac OS analysis tools

Network forensics tools

Database forensics tools

In this post, we are listing a few important and popular data forensics tools. Before proceeding further, I want to make it clear that tools are added in random order. So, please do not try to consider it as a ranking of the tools.

1. Digital Forensics Framework

Digital Forensics Framework is another popular platform dedicated to digital forensics. The tool is open source and comes under GPL License. It can be used either by professionals or non-experts without any trouble. It can be used for digital chain of custody, to access the remote or local devices, forensics of Windows or Linux OS, recovery hidden of deleted files, quick search for files' meta data, and various other things.

Download: https://github.com/arxsys/dff

2. Open Computer Forensics Architecture

Open Computer Forensics Architecture (OCFA) is another popular distributed open-source computer forensics framework. This framework was built on Linux platform and uses postgreSQL database for storing data.

It was built by the Dutch National Police Agency for automating digital forensics process. It is available to download under GPL license.

Download: http://sourceforge.net/projects/ocfa/

3. CAINE

CAINE (Computer Aided Investigative Environment) is the Linux distro created for digital forensics. It offers an environment to integrate existing software tools as software modules in a user friendly manner. This tool is open source.

Read More about it: http://www.caine-live.net/

4. X-Ways Forensics

X-Ways Forensics is an advanced platform for digital forensics examiners. It runs on all available version of Windows. It claims to not be very resource hungry and to work efficiently. If we talk about the features, find the key features in the list below:

Disk imaging and cloning

Ability to read file system structures inside various image files

It supports most of the file systems including FAT12, FAT16, FAT32, exFAT, TFAT, NTFS, Ext2, Ext3, Ext4, Next3®, CDFS/ISO9660/Joliet, UDF

Automatic detection of deleted or lost hard disk partition

Various data recovery techniques and powerful file carving

Bulk hash calculation

Viewing and editing binary data structures using templates

Easy detection of and access NTFS ADS

Well maintained file header

Automated activity logging

Data authenticity

Complete case management

Memory and RAM analysis

Gallery view for pictures

Internal viewer for Windows registry file

Automated registry report

Extracts metadata from various file types

Ability to extract emails from various available email clients.

And many more..

You can read the full list here: http://www.x-ways.net/forensics/

5. EnCase

EnCase is another popular multi-purpose forensic platform with many nice tools for several areas of the digital forensic process. This tool can rapidly gather data from various devices and unearth potential evidence. It also produces a report based on the evidence.

This tool does not come for free (see site for current pricing).

Read more about EnCase: https://www.guidancesoftware.com/products/Pages/encase-forensic/overview.aspx

6. Registry Recon

Registry Recon is a popular registry analysis tool. It extracts the registry information from the evidence and then rebuilds the registry representation. It can rebuild registries from both current and previous Windows installations.

It is not a free tool. It costs $399.

Read more about it: http://arsenalrecon.com/apps/recon/

7. The Sleuth Kit

The Sleuth Kit is a Unix and Windows based tool which helps in forensic analysis of computers. It comes with various tools which helps in digital forensics. These tools help in analyzing disk images, performing in-depth analysis of file systems, and various other things.

Read more about it here: http://www.sleuthkit.org/

Ethical Hacking Boot Camp - 93% Exam Pass Rate

8. Llibforensics

Libforensics is a library for developing digital forensics applications. It was developed in Python and comes with various demo tools to extract information from various types of evidence.

Read more here: http://code.google.com/p/libforensics/

9. Volatility

Volatility is the memory forensics framework. It used for incident response and malware analysis. With this tool, you can extract information from running processes, network sockets, network connection, DLLs and registry hives. It also has support for extracting information from Windows crash dump files and hibernation files. This tool is available for free under GPL license.

Read more about the tool: http://code.google.com/p/volatility/

10. WindowsSCOPE

WindowsSCOPE is another memory forensics and reverse engineering tool used for analyzing volatile memory. It is basically used for reverse engineering of malwares. It provides the capability of analyzing the Windows kernel, drivers, DLLs, virtual and physical memory.

Read more: http://www.windowsscope.com/index.php

11. The Coroner's Toolkit

The Coroner's Toolkit or TCT is also a good digital forensic analysis tool. It runs under several Unix-related operating systems. It can be used to aid analysis of computer disasters and data recovery.

Read more: http://www.porcupine.org/forensics/tct.html

12. Oxygen Forensic Suite

Oxygen Forensic Suite is a nice software to gather evidence from a mobile phone to support your case. This tool helps in gathering device information (including manufacturer, OS, IMEI number, serial number), contacts, messages (emails, SMS, MMS), recover deleted messages, call logs and calendar information. It also lets you access and analyze mobile device data and documents. It generates easy to understand reports for better understanding.

More information here: http://www.oxygen-forensic.com/en/features

13. Bulk Extractor

Bulk Extractor is also an important and popular digital forensics tool. It scans the disk images, file or directory of files to extract useful information. In this process, it ignores the file system structure, so it is faster than other available similar kinds of tools. It is basically used by intelligence and law enforcement agencies in solving cyber crimes.

Download it here: http://digitalcorpora.org/downloads/bulk_extractor/

14. Xplico

Xplico is an open source network forensic analysis tool. It is basically used to extract useful data from applications which use Internet and network protocols. It supports most of the popular protocols including HTTP, IMAP, POP, SMTP, SIP, TCP, UDP, TCP and others. Output data of the tool is stored in SQLite database of MySQL database. It also supports IPv4 and IPv6 both.

Read more about this tool here: http://www.xplico.org/about

15. Mandiant RedLine

Mandiant RedLine is a popular tool for memory and file analysis. It collects information about running processes on a host, drivers from memory and gathers other data like meta data, registry data, tasks, services, network information and Internet history to build a proper report.

Read more here: https://www.mandiant.com/resources/download/redline

16. Computer Online Forensic Evidence Extractor (COFEE)

Computer Online Forensic Evidence Extractor or COFEE is a tool kit developed for computer forensic experts. This tool was developed by Microsoft to gather evidence from Windows systems. It can be installed on a USB pen drive or external hard disk. Just plug in the USB device in the target computer and it starts a live analysis. It comes with 150 different tools with a GUI based interface to command the tools. It is fast and can perform the whole analysis in as few as 20 minutes. To law enforcement agencies, Microsoft provides free technical support for the tool.

Official website: https://cofee.nw3c.org/

17. P2 eXplorer

P2 eXplorer is a forensic image mounting tool which aims to help investigating officers with examination of a case. With this image, you can mount forensic images as a read-only local and physical disc and then explore the contents of the image with file explorer. You can easily view deleted data and unallocated space of the image.

It can mount several images at a time. It supports most of the image formats including EnCasem, safeBack, PFR, FTK DD, WinImage, Raw images from Linux DD, and VMWare images. It supports both logical and physical image types.

This tool comes for $199, but you can grab the limited feature version of the tool for free.

Read more here: https://www.paraben.com/p2-explorer.html

18. PlainSight

PlainSight is another useful digital forensics tool. It is a CD based Knoppix which is a Linux distribution. Some of its uses include viewing Internet histories, data carving, checking USB device usage, memory dumps extracting password hashes, information gathering, examining Windows firewall configuration, seeing recent documents, and other useful tasks. For using this too, you only need to boot from the CD and the follow the instructions.

This tool is available for free.

Read more here: http://www.plainsight.info/index.html

19. XRY

XRY is the mobile forensics tool developed by Micro Systemation. It is used to analyze and recover crucial information from mobile devices. This tool comes with a hardware device and software. Hardware connects mobile phones to PC and software performs the analysis of the device and extract data. It is designed to recover data for forensic analysis.

The latest version of the tool can recover data from all kind of smartphones including Android, iPhone and BlackBerry. It gathers deleted data like call records, images, SMS and text messages.

Read more about it: http://www.msab.com/xry/what-is-xry

20. HELIX3

HELIX3 is a live CD-based digital forensic suite created to be used in incident response. It comes with many open source digital forensics tools including hex editors, data carving and password cracking tools. If you want the free version, you can go for Helix3 2009R1. After this release, this project was overtaken by a commercial vendor. So, you need to pay for most recent version of the tool.

This tool can collect data from physical memory, network connections, user accounts, executing processes and services, scheduled jobs, Windows Fegistry, chat logs, screen captures, SAM files, applications, drivers, environment variables and Internet history. Then it analyzes and reviews the data to generate the complied results based on reports.

Helix3 2008R1 can be downloaded here: https://e-fenseinc.sharefile.com/d/sda4309a624d48b88

The enterprise version is available here: http://www.e-fense.com/h3-enterprise.php

21. Cellebrite UFED

Cellebrite's UFED solutions present a unified workflow to allow examiners, investigators and first responders to collect, protect and act decisively on mobile data with the speed and accuracy a situation demands - without ever compromising one for the other. The UFED Pro Series is designed for forensic examiners and investigators who require the most comprehensive, up-to-date mobile data extraction and decoding support available to handle the influx of new data sources. Platform agnostic, the UFED Field Series is designed to unify workflows between the field and lab, making it possible to view, access and share mobile data via in-car workstations, laptops, tablets or a secure, self-service kiosk located at a station.

More information here: http://www.cellebrite.com/Mobile-Forensics

Would you like to test your skills further with a CTF challenge? Check this out:

Conclusion

These are a few popular digital forensics tools used by various law enforcement agencies in performing crime investigations. In this post, I added all kind of tools like premium, free, open source, computer forensics, mobile forensics and others. If you are going to start learning digital forensics, you can download or buy these tools and start working on those. It will help you in better understanding the whole process and tools.

These are not the only tools. There are various other free and premium tools available in the market. So, you can do more research on the tools to know more about those tools. These tools are added in random order. So, please don't consider it as a ranking of the tools. I just tried to make a list of popular digital forensics tools only.

With the increasing use of digital data and mobile phones, digital forensics has become more important. Cyber crimes are also increasing day by day. So companies are also trying to launch more powerful version of the tools, and you need to be in touch of latest digital forensics news to know about recent releases.

If you're in the market to find forensics training for law enforcement, check out InfoSec Institute's computer forensics training boot camp. Just fill out the form at the top of this post to receive more info.

Further reading about digital forensics:

More articles about digital forensics:
Top Online Digital Computer Forensics Resources 7 Best Computer Forensics Tools

# data[].attributes.attachment_link.title
Popular Computer Forensics Top 21 Tools [Updated for 2019]

# data[].attributes.attachment_link.description
Computer forensics is a very important branch of computer science in relation to computer and Internet related crimes. Earlier, computers were only used to produce data but now it has expanded to all devices related to digital data.

# data[].attributes.attachment_link.readable_text
Introduction

According to Juniper Research, cybercrime losses to businesses will surpass $2 trillion by the year 2019. With data breaches occurring all around the world every day, the demand for experts in computer forensics will also increase. Whether you need to investigate an unauthorized server access, look into an internal case of human resources, or are interested in learning a new skill, these free and open source computer forensics tools will help you conduct in-depth analysis, including hard drive forensics, memory analysis, forensic image exploration, and mobile forensics. However, this is not an extensive list by all means and may not cover all necessary tools required for a complete investigation. It only includes some of the popular and useful tools. Using the right tools can always help you move things faster and result in more productive results.

Forensic Toolkits

These are multipurpose forensic toolkits that can carry out a number of detailed digital forensic tasks.

SANS Investigative Forensic Toolkit (SIFT)

Based on Ubuntu, SIFT has all the important tools needed to carry out a detailed forensic analysis or incident response study. It supports analysis in advanced forensic format (AFF), expert witness format (E01) and RAW evidence (DD) format. It comes with tools to carve data files, generate timeline from system logs, examine recycle bins, and much more.

SIFT provides user documentation that allows you to get accustomed to the available tools and their usage. It also explains where evidence can be found on a system. Tools can be opened manually from the terminal window or with the help of top menu bar.

Having more than 100,000 downloads to date, SIFT continues to be a widely used open-source forensic and incident response tool.
New key features Include:

Ubuntu LTS 16.04 Base

64-bit base system

Auto-DFIR package update and customization

VMware appliance ready to tackle forensics

Cross-compatibility between Windows and Linux

Choice to install stand-alone via (.iso) or use via VMware Player/Workstation

Online documentation project athttp://sift.readthedocs.org/

Pros: Better utilization of memory, modern forensic tools and techniques, expanded file system support.
Link: https://digital-forensics.sans.org/community/downloads
Sleuth Kit Autopsy
Key features of Autopsy include:
Autopsy is a digital forensics platform that efficiently analyzes smartphones and hard disks. It is used worldwide by a large number of users, including law enforcement agencies, the military, and corporations to carry out investigations on a computer system. It has an easy-to-use interface, processes data fast, and is cost-effective. Sleuth Kit is a collection that consists of command line tools and a C library allowing the analysis of disk images and file recovery. It is used at the back end in the Autopsy tool.

Timeline Analysis-Advanced interface for graphical event viewing.

Hash Filtering-Flags known bad files and overlooks known good files.

Keyword Search-Indexed keyword search makes file search easier.

Web Artifacts-Extracting bookmarks, history, and cookies from web browsers.

Data Carving-Recovering deleted files from unallocated space by using PhotoRec.

Multimedia-Extracting EXIF from pictures and watching videos.

Compromise Indicators-Scanning a computer using STIX.

Pros: Good documentation and support

Cons: It requires special user skills because it is based on Unix.

Link: http://www.sleuthkit.org/autopsy/

Oxygen Forensic Suite
Some more important features include:
Available in free and professional versions, this forensics tool helps you to collect evidence from a mobile phone. It collects all device information such as serial number, IMEI, OS, etc., and recovers messages, contacts and call logs. Its file browser feature enables you to have access to and analyze photos, documents, videos and device database.

Built-in cloud data recovery.

Contact aggregation helps to identify linked profiles from all sources, including app accounts.

Social graph features identify most frequently communicated contacts, making it easier to conduct the investigation.

Map feature locates all check-ins, map lookups, visited websites, and messages containing geolocation metadata of all the devices being studied under the case.

Timeline feature reveals the most active user hours and most common ways in which the device is operated.

Allows importing messages from three other mobile forensic tools, JTAG/ISP images, RAW/DD files, and chip-off dumps.

Pros: It provides several ways to extract data including Bluetooth, USB cable, iTunes backups, other forensic software backups, and Android backups. Also, the main interface is straightforward and easy to use. It provides sophisticated data analysis and has several useful data analysis features.

Cons: Unlike its competitors XRY and UFED, its free version does not provide advanced features such as cracking Android backups or locked iPhone.

Link: https://www.oxygen-forensic.com/en/

DEFT Zero
Some of its useful features are as follows:
DEFT (digital evidence and forensics toolkit) is a Linux-based distribution that allows professionals and non-experts to gather and preserve forensic data and digital evidence. The free and open source operating system has some of the best computer forensics open source applications. DEFT Zero is a lightweight version released in 2017.

Supports 32 and 64 bit hardware with UEFI and secure boot.

Supports NVMExpress memories and eMMC memories.

DEFT Zero Linux 2017.1 can be operated in three booting modes: GUI mode, RAM preload GUI mode, and text mode.

Link: http://www.deftlinux.net/2017/02/13/deft-zero-2017-1-ready-for-download/
Pros: Needs only 400 MB memory to run. This means that it can be run even on a slow or obsolete PC.

Network Forensic Tools

These tools help in the extraction and forensic analysis of activity across the network.

WireShark

WireShark is one of the most commonly used network protocol analyzers. It allows you to investigate your network activity at the microscopic level. Wireshark is widely used by government agencies, corporations and educational institutes.

Allows deep investigation into many protocols, with the number of protocols being added constantly.

Offline and online analysis.

Supports multiple platforms that include Windows, Solaris, Linux, FreeBSD, Mac OS, NetBSD, and others.

Network data can by browsed through TTY mode (Tshark utility) or a graphical user interface.

Powerful display filters.

Strong VoIP analysis

Reading/writing enabled in multiple file formats, such as tcpdump (libpcap), Cisco Secure IDS iplog, Network General Sniffer® (compressed and uncompressed), Novell LANalyzer, to name a few.

Data can be read live from IEEE 802.11, Ethernet, FDDI, Token Ring, and others.

Supports decryption for various protocols, including Kerberos, ISAKMP, IPsec, SSL/TLS, WPA/WPA2, and WEP.

Supports the export of output to CSV, XML, or plain text

Pros: Digs deep to uncover minor details in the network data.

Cons: Does not exactly pinpoint the solution you are looking for and dumps raw data into large files for you to figure out.

Link: www.wireshark.org

Network Miner

This is a network forensic analysis tool (NFAT) for Windows, Mac OS X, Linux, and FreeBSD. These tools come in a free edition as well as a professional paid edition. Network Miner's free edition can

Work as a passive network sniffer that captures packets to detect hostnames, sessions, open ports and operating systems without generating traffic on network.

Allow for offline analysis by parsing PCAP files.

Regenerate transmitted certificates and files from PCAP files.

Save time of forensic analysts by presenting extracted data with a user-friendly interface.

Pros: Captures network traffic, investigates potential rogue hosts, assembles and extracts files from captured traffic.

Link: http://www.filecroco.com/download-networkminer

Xplico

This is an open-source network forensic analysis tool (NFAT) that can extract app data from internet traffic. For instance, Xplico can extract email, HTTP contents, VoIP call, FTP, TFTP, etc., from a pcap file. Important features of Xplico are:

Supports HTTP, IMAP, POP, SIP, SMTP, UDP, TCP, Ipv6 protocols

Multithreading

Port-independent protocol identification for application protocol

Outputs data and information as a MySQL or SQLite database

Associates an XML file with each reassembled data set

Reverse DNS lookup

No size limit on number of files or data size

Supports IPv4 and IPv6

Modular components, i.e., input interface, output interface, and protocol decoder.

Pros: There is no size limit on number of files or data size. Its command line shows more detail and its geo-map feature can be used in web interface as well as console mode.

Cons: it is not possible to copy packets and send them to two separate dissectors; instead, there is the possibility of losing the packets, as the average processing time for a packet is higher than the average number of packets per second in Xplico.

Link: www.xplico.org

Forensic Imaging Tools

These tools help in analyzing disk images at microscopic level.

FTK Imager

this is a data preview and imaging tool with which one can study files and folders on a hard drive, network drive, and CDs/DVDs. It allows you to:

review forensic memory dumps or images.

create MD5 or SHA1 file hashes that are already deleted from the recycle bin, if their data blocks have not already been overwritten.

mount forensic images to view their contents in browser.

Pros: Creates bit-by-bit image and creates exact replica of the drive, thus allowing the investigator to view deleted or irretrievable files. It also creates a keyword index for every image, which makes future searches easier.

Cons: It doesn't carve files and lacks recursive export capabilities.

Link: http://accessdata.com/product-download/ftk-imager-version-3.4.3

Linux "dd"

Linux dd is a powerful tool that is installed by default in most Linux distributions (Fedora, Ubuntu). It can be used for conducting a number of forensic tasks like creating raw image of a folder, file, or drive.

On the negative side, it can be quite destructive if not used properly, thus earning the name "Data Destroyer" from some users. It is therefore advisable to test the command in a safe environment first and then apply it to the real data.
Key features include:
IXImager

This comes with a small, and fast-booting forensic image analysis in a microkernel that runs from portable media. It physically boots the device, captures and authenticates a computer system, and reconstructs the filesystem.

Securely accounts for data corruption.

Documents and records data tampering.

Uses high-speed data compression RW.

Has the capability for data to span different file systems, media types and output devices.

Creates detailed data acquisition logs.

Creates encrypted authentication log file for user actions and locks it to prevent it from being tampered.

Link: https://www.perlustro.com/solutions/e-forensics/iximager

Memory Forensics

Magnet RAM Capture

Magnet Ram Capture is one of the many tools provided by Magnet Forensics. It is a free tool that captures the physical memory of a computer. This can help forensic investigators recover and analyze useful artifacts in the computer's memory.

Having a small memory footprint, the tool can be run while the overwritten data in the memory is minimized. The collected memory data can be exported in RAW format and uploaded into any of the forensic analysis tools.

RAM evidence captured by the tool includes processes and programs, network connections, registry hives, malware intrusion evidence, decrypted keys and files, usernames and passwords, and any other activity not usually stored on the hard disk.

Pros: Acquires full physical memory fast and leaves small footprint on live system that is under analysis.

Link: https://www.magnetforensics.com/free-digital-forensics-software-tools/

Memoryze

This free memory forensic tool helps discover malicious activity in live memory. It can acquire and analyze images from memory.
Link: https://www.fireeye.com/services/freeware/memoryze.html
Key features include:

Creating an image of entire system memory.

Creating an image of a specific driver or all drivers in memory to the disk.

Creating an image of the complete address space of a process to disk.

Counting all running process and listing them.

Identifying drivers that are loaded in memory.

Its key features include:
Website Forensics

FAW (Forensics Acquisition of Websites)

This is the first browser that can acquire web pages from websites available online to conduct forensic investigation.

Viewing and editing host files.

Audio/video capture.

Acquiring code for iFrames on the webpage.

Acquiring IP address and hostname of webpage.

Support for English, French, Italian, and Polish languages.

Improved performance and stability.

Pros: It extracts image files on webpages being viewed. It can capture files such as JavaScript and CSS on a website, which can help detect malware. It preserves a webpage while it is being viewed by a user.

Link: www.fawproject.com

Removable Media Forensics
Link: http://www.4discovery.com/our-tools/
USB Historian

This tool can parse all your USB history information from your windows plug-and-play registry. This can give you a complete record of the USB drives that were inserted into the machine. The tool is originally intended to conduct forensic investigations related to stealing, movement, or unauthorized access to data.

Pros: Parses computer name to located devices quickly, features wizard-driven analysis, parses backup logs and SetupAPI logs.

Be Safe

Learn more

# data[].attributes.attachment_link.description
According to Juniper Research, cybercrime losses to businesses will surpass $2 trillion by the year 2019. With data breaches occurring all around the world every day, the demand for experts in computer forensics will also increase.

# data[].attributes.attachment_link.readable_text
Here are 20 of the best free tools that will help you conduct a digital forensic investigation. Whether it's for an internal human resources case, an investigation into unauthorized access to a server, or if you just want to learn a new skill, these suites and utilities will help you conduct memory forensic analysis, hard drive forensic analysis, forensic image exploration, forensic imaging and mobile forensics. As such, they all provide the ability to bring back in-depth information about what's "under the hood" of a system.

This is by no means an extensive list and may not cover everything you need for your investigation. You might also need additional utilities such a file viewers, hash generators, and text editors - checkout 101 Free Admin Tools for some of these.

My articles on Top 10 Free Troubleshooting Tools for SysAdmins, Top 20 Free Network Monitoring and Analysis Tools for Sys Admins and Top 20 Free File Management Tools for Sys Admins might also come in handy since they contain a bunch of tools that can be used for Digital Forensic Investigations (e.g. BackTrack and the SysInternals Suite or the NirSoft Suite of tools).

Even if you may have heard of some of these tools before, I'm confident that you'll find a gem or two amongst this list.

The SANS Investigative Forensic Toolkit (SIFT) is an Ubuntu based Live CD which includes all the tools you need to conduct an in-depth forensic or incident response investigation. It supports analysis of Expert Witness Format (E01), Advanced Forensic Format (AFF), and RAW (dd) evidence formats. SIFT includes tools such as log2timeline for generating a timeline from system logs, Scalpel for data file carving, Rifiuti for examining the recycle bin, and lots more.

When you first boot into the SIFT environment, I suggest you explore the documentation on the desktop to help you become accustomed to what tools are available and how to use them. There is also a good explanation of where to find evidence on a system. Use the top menu bar to open a tool, or launch it manually from a terminal window.

ProDiscover Basic is a simple digital forensic investigation tool that allows you to image, analyse and report on evidence found on a drive. Once you add a forensic image you can view the data by content or by looking at the clusters that hold the data. You can also search for data using the Search node based on the criteria you specify.

When you launch ProDiscover Basic you first need to create or load a project and add evidence from the 'Add' node. You can then use the 'Content View' or 'Cluster View' nodes to analyse the data and the Tools menu to perform actions against the data. Click the 'Report' node to view important information about the project.

Volatility is a memory forensics framework for incident response and malware analysis that allows you to extract digital artefacts from volatile memory (RAM) dumps. Using Volatility you can extract information about running processes, open network sockets and network connections, DLLs loaded for each process, cached registry hives, process IDs, and more.

If you are using the standalone Windows executable version of Volatility, simply place volatility-2.1.standalone.exe into a folder and open a command prompt window. From the command prompt, navigate to the location of the executable file and type "volatility-2.1.standalone.exe -f <FILENAME> -profile=<PROFILENAME> <PLUGINNAME>" without quotes - FILENAME would be the name of the memory dump file you wish to analyse, PROFILENAME would be the machine the memory dump was taken on and PLUGINNAME would be the name of the plugin you wish to use to extract information.

Note: In the example above I am using the 'connscan' plugin to search the physical memory dump for TCP connection information.

The Sleuth Kit is an open source digital forensics toolkit that can be used to perform in-depth analysis of various file systems. Autopsy is essentially a GUI that sits on top of The Sleuth Kit. It comes with features like Timeline Analysis, Hash Filtering, File System Analysis and Keyword Searching out of the box, with the ability to add other modules for extended functionality.

Note: You can use The Sleuth Kit if you are running a Linux box and Autopsy if you are running a Windows box.

When you launch Autopsy, you can choose to create a new case or load an existing one. If you choose to create a new case you will need to load a forensic image or a local disk to start your analysis. Once the analysis process is complete, use the nodes on the left hand pane to choose which results to view.

FTK Imager is a data preview and imaging tool that allows you to examine files and folders on local hard drives, network drives, CDs/DVDs, and review the content of forensic images or memory dumps. Using FTK Imager you can also create SHA1 or MD5 hashes of files, export files and folders from forensic images to disk, review and recover files that were deleted from the Recycle Bin (providing that their data blocks haven't been overwritten), and mount a forensic image to view its contents in Windows Explorer.

Note: There is a portable version of FTK Imager that will allow you to run it from a USB disk.

When you launch FTK Imager, go to 'File > Add Evidence Item...' to load a piece of evidence for review. To create a forensic image, go to 'File > Create Disk Image...' and choose which source you wish to forensically image.

06 Linux 'dd'

dd comes by default on the majority of Linux distributions available today (e.g. Ubuntu, Fedora). This tool can be used for various digital forensic tasks such as forensically wiping a drive (zero-ing out a drive) and creating a raw image of a drive.

Note: dd is a very powerful tool that can have devastating effects if not used with care. It is recommended that you experiment in a safe environment before using this tool in the real world.

Tip: A modified version of dd is available from http://sourceforge.net/projects/dc3dd/ - dc3dd includes additional features that were added specifically for digital forensic acquisition tasks.

To use dd, simply open a terminal window and type dd followed by a set of command parameters (which command parameters will obviously depend on what you want to do). The basic dd syntax for forensically wiping a drive is:

dd if=/dev/zero of=/dev/sdb1 bs=1024
where if = input file, of = output file, bs = byte size

Note: Replace /dev/sdb1 with the drive name of the drive you want to forensically wipe and 1024 with the size of the byte blocks you want to write out.

The basic dd syntax for creating a forensic image of a drive is:

dd if=/dev/sdb1 of=/home/andrew/newimage.dd bs=512 conv=noerror,sync

where if = input file (or in this case drive), of = output file, bs = byte size, conv = conversion options

Tip: For additional usage info, from a terminal window, type "man dd" without quotes to bring up the help manual for the dd command.

CAINE (Computer Aided INvestigative Environment) is Linux Live CD that contains a wealth of digital forensic tools. Features include a user-friendly GUI, semi-automated report creation and tools for Mobile Forensics, Network Forensics, Data Recovery and more.

When you boot into the CAINE Linux environment, you can launch the digital forensic tools from the CAINE interface (shortcut on the desktop) or from each tool's shortcut in the 'Forensic Tools' folder on the applications menu bar.

If you are investigating a case that requires you to gather evidence from a mobile phone to support your case, Oxygen Forensics Suite (Standard Edition) is a tool that will help you achieve this. Features include the ability to gather Device Information (Manufacturer, OS Platform, IMEI, Serial Number, etc.), Contacts, Messages (Emails, SMS, MMS, etc.) and recovery of deleted messages, Call Logs, and Calendar and Task information. It also comes with a file browser which allows you to access and analyse user photos, videos, documents and device databases.

When you launch Oxygen Forensic Suite, hit the 'Connect new device' button on the top menu bar to launch the Oxygen Forensic Extractor wizard that guides you through selecting the device and type of information you wish to extract.

Free Hex Editor Neo is a basic hex editor that was designed to handle very large files. While a lot of the additional features are found in the commercial versions of Hex Editor Neo, I find this tool useful for loading large files (e.g. database files or forensic images) and performing actions such as manual data carving, low-level file editing, information gathering, or searching for hidden data.

Use 'File > Open' to load a file into Hex Editor Neo. The data will appear in the middle window where you can begin to navigate through the hex manually or press CTRL + F to run a search.

bulk_extractor is a computer forensics tool that scans a disk image, file, or directory of files and extracts information such as credit card numbers, domains, e-mail addresses, URLs, and ZIP files. The extracted information is output to a series of text files (which can be reviewed manually or analysed using other forensics tools or scripts).

Tip: Within the output text files you will find entries for data that resemble a credit card number, e-mail address, domain name, etc. You will also see a decimal value in the first column of the text file that, when converted to hex, can be used as the pointer on disk where the entry was found (i.e. if you were analysing the disk manually using a hex editor for example, you would jump to this hexadecimal value to view the data).

Bulk_extractor comes as a command-line tool or a GUI tool. In the example above I set the bulk extractor tool to extract information from a forensics image I took earlier and output the results to a folder called "BE_Output". The results can then be viewed in the Bulk Extractor Viewer and the output text files mentioned above.

DEFT is another Linux Live CD which bundles some of the most popular free and open source computer forensic tools available. It aims to help with Incident Response, Cyber Intelligence and Computer Forensics scenarios. Amongst others, it contains tools for Mobile Forensics, Network Forensics, Data Recovery, and Hashing.

When you boot using DEFT, you are asked whether you wish to load the live environment or install DEFT to disk. If you load the live environment you can use the shortcuts on the application menu bar to launch the required tools.

Xplico is an open source Network Forensic Analysis Tool (NFAT) that aims to extract applications data from internet traffic (e.g. Xplico can extract an e-mail message from POP, IMAP or SMTP traffic). Features include support for a multitude of protocols (e.g. HTTP, SIP, IMAP, TCP, UDP), TCP reassembly, and the ability to output data to a MySQL or SQLite database, amongst others.

Once you've installed Xplico, access the web interface by navigating to http://<IPADDRESS>:9876 and logging in with a normal user account. The first thing you need to do is create a case and add a new session. When you create a new session you can either load a PCAP file (acquired from Wireshark for example) or start a live capture. Once the session has finished decoding, use the navigation menu on the left hand side to view the results.

I briefly touched on LastActivityView when pointing out the NirSoft suite of tools in my Top 10 Free System Troubleshooting Tools for SysAdmins article. LastActivityView allows you to view what actions were taken by a user and what events occurred on the machine. Any activities such as running an executable file, opening a file/folder from Explorer, an application or system crash or a user performing a software installation will be logged. The information can be exported to a CSV / XML / HTML file. This tool is useful when you need to prove that a user (or account) performed an action he or she said they didn't.

When you launch LastActivityView, it will immediately start displaying a list of actions taken on the machine it is being run on. Sort by action time or use the search button to start investigating what actions were taken on the machine.

DSi USB Write Blocker is a software-based write blocker that prevents write access to USB devices. This is important in an investigation to prevent modifying the metadata or timestamps and invalidating the evidence.

When you run DSi USB Write Blocker, it brings up a window that allows you to enable or disable the USB Write Blocker. Once you make changes and exit the application, you can keep an eye on the status from the padlock icon in the taskbar. When performing an analysis of a USB drive, enable the USB Write Blocker first and then plug the USB drive in.

Note: If you are looking for a command line alternative USB Write Blocker, check out 'USB Write Blocker for ALL Windows': http://sourceforge.net/projects/usbwriteblockerforwindows8/

RedLine offers the ability to perform memory and file analysis of a specific host. It collects information about running processes and drivers from memory, and gathers file system metadata, registry data, event logs, network information, services, tasks, and Internet history to help build an overall threat assessment profile.

When you launch RedLine, you will be given a choice to Collect Data or Analyze Data. Unless you already have a memory dump file available, you'll need to create a collector to gather data from the machine and let that process run through to completion. Once you have a memory dump file to hand you can begin your analysis.

PlainSight is a Live CD based on Knoppix (a Linux distribution) that allows you to perform digital forensic tasks such as viewing internet histories, data carving, USB device usage information gathering, examining physical memory dumps, extracting password hashes, and more.

When you boot into PlainSight, a window pops up asking you to select whether you want to perform a scan, load a file or run the wizard. Enter a selection to begin the data extraction and analysis process.

HxD is one of my personal favourites. It is a user-friendly hex editor that allows you to perform low-level editing and modifying of a raw disk or main memory (RAM). HxD was designed with easy-of-use and performance in mind and can handle large files without issue. Features include searching and replacing, exporting, checksums/digests, an in-built file shredder, concatenation or splitting of files, generation of statistics and more.

From the HxD interface start your analysis by opening a file from 'File > Open', loading a disk from 'Extras > Open disk...' or loading a RAM process from 'Extras > Open RAM...'

HELIX3 is a Live CD based on Linux that was built to be used in Incident Response, Computer Forensics and E-Discovery scenarios. It is packed with a bunch of open source tools ranging from hex editors to data carving software to password cracking utilities, and more.

Note: The HELIX3 version you need is 2009R1. This version was the last free version available before HELIX was taken over by a commercial vendor. HELIX3 2009R1 is still valid today and makes for a useful addition to your digital forensics toolkit.

When you boot using HELIX3, you are asked whether you want to load the GUI environment or install HELIX3 to disk. If you choose to load the GUI environment directly (recommended), a Linux-based screen will appear giving you the option to run the graphical version of the bundled tools.

Paladin Forensic Suite is a Live CD based on Ubuntu that is packed with wealth of open source forensic tools. The 80+ tools found on this Live CD are organized into over 25 categories including Imaging Tools, Malware Analysis, Social Media Analysis, Hashing Tools, etc.

After you boot Paladin Forensic Suite, navigate to the App Menu or click on one of the icons in the taskbar to get started.

Note: A handy Quick Start Guide for Paladin Forensic Suite is available to view or download from the Paladin website as well as the taskbar within Paladin itself.

USB Historian parses USB information, primarily from the Windows registry, to give you a list of all USB drives that were plugged into the machine. It displays information such as the name of the USB drive, the serial number, when it was mounted and by which user account. This information can be very useful when you're dealing with an investigation whereby you need to understand if data was stolen, moved or accessed.

When you launch USB Historian, click the '+' icon on the top menu to launch the data parse wizard. Select which method you want to parse data from (Drive Letter, Windows and Users Folder, or Individual Hives/Files) and then select the respective data to parse. Once complete you will see information similar to that shown in the above image.

# data[].attributes.attachment_link.title
Top 20 Free Digital Forensic Investigation Tools for SysAdmins

# data[].attributes.attachment_link.description
Here are 20 of the best free tools that will help you conduct a digital forensic investigation. Whether it's for an internal human resources case, an investigation into unauthorized access to a server, or if you just want to learn a new skill, these suites a perfect place to start.

# data[].attributes.attachment_link.title
Caesar Cipher (Shift) - Online Decoder, Encoder, Solver, Translator

# data[].attributes.attachment_link.description
Tool to decrypt/encrypt with Caesar cipher (or Caesar code), a shift cipher, one of the most easy and most famous encryption systems, that uses the substitution of a letter by another one further in the alphabet.