A JonnyTech guide to forensics tools.
Summary
Digital forensics tools do different jobs. Some pull data off hard drives. Others analyze deleted files. Some inspect email, others examine memory. Learning which tool does what—and when to use it—is the foundation of forensic work. The good news: many powerful tools are free, perfect for learning. The professional versions add enterprise features if you need them.
Disk & File Analysis Tools
These tools let you examine hard drive images and recover deleted files.
Autopsy (Free)
What it does: Autopsy is a free program that lets you examine hard drive images like looking through filing cabinets. It finds deleted files, recovers data, and builds timelines of when things happened.
Remember it like this: Think of it as a digital detective tool—it reads a snapshot of a drive and pieces together the story.
Why it's great for learning: Free, open-source, and widely used. If you can use Autopsy, you understand the fundamentals of digital forensics.
How it works: You give it a hard drive image (a bit-for-bit copy), and it shows you:
- All files (deleted and active)
- Timeline of file creation/modification
- File content and metadata
- Deleted file recovery
X-Ways Forensics ($1,500–$4,000)
What it does: A professional Windows tool for deep, detailed disk analysis. It examines every part of a hard drive including hidden metadata and low-level data structures.
Remember it like this: Like comparing a basic camera to a professional forensic lab—much more powerful but costs money.
When to use it: Enterprise investigations where you need maximum detail and can justify the cost.
Email Forensics Tools
Email investigations require specialized tools that preserve evidence without changing it.
Forensic Email Collector (~$1,750 per license)
What it does: A specialized tool that safely collects email from servers and accounts without changing anything. It preserves the evidence exactly as it was.
Remember it like this: Like making a photocopy of documents before analyzing them—the original stays untouched.
Key feature: Non-destructive collection. Critical for chain of custody. You're not modifying the original mailbox while collecting evidence.
Aid4Mail ($999–$5,000/year)
What it does: Email processing tool that searches, filters, and exports email from different systems and formats. Turns messy email data into organized evidence.
Remember it like this: A translator for email—it takes mail from different systems and organizes it in a standard way.
Why it's useful: Email lives in many places—Exchange servers, Gmail, Outlook files, archived folders. Aid4Mail reads them all and exports into a searchable format.
Disk Capture & Imaging Tools
Before you analyze anything, you need to make a perfect copy.
FTK Imager (Free)
What it does: A free tool that creates exact copies (bit-for-bit images) of storage drives and lets you preview evidence without changing the original disk.
Remember it like this: Like making a perfect photocopy of a hard drive—nothing changes on the original, but you have a complete copy to examine.
Key feature: Calculates MD5 and SHA-1 hashes while copying. This proves your copy matches the original perfectly.
Bonus: The portable version fits on a USB drive. You can take it anywhere.
Magnet ACQUIRE (Free)
What it does: A free utility that captures forensic images from computers and mobile devices. Creates bit-perfect copies of storage media.
Remember it like this: The portable version of FTK Imager—works on computers and phones.
Why it's great: Mobile forensics in one tool. Most cases now involve phones or tablets.
Windows Registry Analysis
The Windows Registry is where the OS stores system settings and user data. It's a goldmine of forensic artifacts.
Registry Explorer (Free)
What it does: Examines Windows Registry files without modifying anything. Shows timestamps and artifacts that reveal what the user did.
Remember it like this: Like reading a computer's memory book—everything Windows remembers is written there.
What you find in Registry:
- Applications installed (with timestamps)
- URLs visited
- USB devices connected
- User activity
- Last login times
- Running services
RegRipper (Free)
What it does: A free open-source tool that automatically extracts useful information from Registry hives by running plugins. Finds forensically important artifacts quickly.
Remember it like this: Like having a specialized filter that pulls out the important stuff from Registry files automatically.
How it helps: Instead of manually digging through thousands of Registry entries, RegRipper runs plugins that know what to look for. Saves hours of work.
Memory Forensics Tools
RAM (active memory) captures what was running at the moment the computer was frozen. It's fleeting data, but powerful evidence.
Volatility 3 (Free)
What it does: A free framework for analyzing RAM. Finds running processes, programs, network activity, and malware hidden in memory.
Remember it like this: Memory is like a computer's temporary thoughts—capture them before they disappear, then analyze what was running.
What you can extract:
- Running processes (including hidden ones)
- Network connections
- Loaded DLLs and drivers
- Malware signatures
- Encryption keys (sometimes)
- Clipboard contents
- Screen captures
Belkasoft RAM Capturer (Free)
What it does: A free tool that captures a Windows computer's active memory (RAM) so you can analyze what was happening right when you captured it.
Remember it like this: Like taking a snapshot of the computer's brain—what's in memory right now.
Why it matters: Malware lives in RAM. If you shut down the computer normally, malware disappears. This tool captures it before it vanishes.
Network Forensics Tools
Network forensics captures and analyzes data traveling between computers.
Wireshark (Free)
What it does: A free program that captures and examines network traffic (data sent between computers). Shows every packet of data and what protocol it uses.
Remember it like this: Like wiretapping a phone line—you see every conversation happening on the network.
What you see:
- Every packet sent and received
- Source and destination addresses
- Protocols (HTTP, HTTPS, FTP, etc.)
- Payloads (the actual data being transmitted)
- Encrypted traffic (though you can't see inside it without keys)
NetworkMiner (Free community version; $1,300–$6,500 professional)
What it does: A network forensic tool that extracts useful data from packet captures like usernames, files, and session information.
Remember it like this: Wireshark shows you every packet; NetworkMiner organizes and highlights what's actually important.
Why it's useful: Wireshark gives you millions of packets. NetworkMiner extracts:
- Files transmitted
- Email addresses and usernames
- Images sent
- Conversation artifacts
- Session information
Mobile Device Forensics
Phones and tablets are now primary evidence. You need specialized tools.
Cellebrite UFED ($10,000–$20,000/year per license)
What it does: An enterprise mobile forensics platform that extracts and examines data from smartphones and tablets.
Remember it like this: The professional tool for pulling data from phones—expensive but handles everything.
What it extracts:
- Messages (SMS, WhatsApp, iMessage, etc.)
- Call logs
- Contacts
- Photos and videos
- Browsing history
- App data
- Location history
Magnet AXIOM ($8,000–$12,000/year)
What it does: A digital investigation platform that processes evidence from phones, computers, and cloud sources. Centralizes all your evidence in one place.
Remember it like this: Like an evidence management system for all your digital devices in one tool.
Why it's useful: Modern investigations involve multiple devices. AXIOM brings it all together in one interface.
Linux Forensics Tools
Linux systems need specialized tools because the file system is different from Windows.
The Sleuth Kit (Free)
What it does: A free command-line toolkit for analyzing disk images and Linux file systems. Works with many file system types including EXT (Linux's native file system).
Remember it like this: The toolkit for Linux—similar to what Autopsy does for Windows.
Command-line tools included:
mmls: List partition informationfsstat: File system statisticsfls: List files in a directoryicat: Extract a file by inodeils: List inode information
SIFT Workstation (Free)
What it does: A free Linux computer system pre-loaded with forensics and incident-response tools. Ready to boot and start analyzing immediately.
Remember it like this: A ready-made forensics computer—everything you need in one Linux box.
What's included: Autopsy, Volatility, Registry tools, and a dozen other forensics applications. You boot it on a USB drive and everything works.
Choosing Between Free and Professional Tools
Use free tools when:
- Learning and practicing
- Budget is limited
- You need community support and documentation
- Cases are small to medium-sized
Use professional tools when:
- Handling enterprise-scale investigations
- You need priority support and updates
- You need to process thousands of files
- You're building a commercial lab
Many investigations use both: free tools for initial analysis and professional tools for deep dives on important cases.
Study Tip
Start with free tools. Understand how they work. Learn the concepts. Then, when you move to professional tools, you'll understand what they're doing behind the scenes. The fundamentals don't change—only the polish and speed.