Totrtilla – anonymously route TCP/IP and DNS traffic through TOR.It runs on 32 or 64 bit of Windows XP above.Ĭrowd Strike has some other nice tools for investigation. You can view the results in XML, CSV, TSV or HTML with help of CRConvert. Response by Crowd Strike is a windows application to gather system information for incident response and security engagements. USB Write Blocker use Windows registry to write-block USB devices. View the USB drives content without leaving the fingerprint, changes to metadata and timestamps. It works on almost all latest Windows OS.

HashMyFiles will help you to calculate the MD5 and SHA1 hashes.

Capture HTML source code of the web page.

It’s Splunk app and has many tools combined.įAW (Forensics Acquisition of Websites) is to acquire web pages for forensic investigation which has the following features. If you are using Splunk then Forensic Investigator will be a very handy tool. Memory dumps may contain encrypted volume’s password and login credentials for webmails and social network services. RAM Capturer by Belkasoft is a free tool to dump the data from computer’s volatile memory. NMAP is supported on most of the operating systems including Windows, Linux, Solaris, MAC OS, HP-UX etc. NMAP (Network Mapper) is one of the most popular networks and security auditing tools. Network Miner provide extracted artifacts in an intuitive user interface. You can use Magnet RAM capture to capture the physical memory of a computer and analyze artifacts in memory.Īn interesting network forensic analyzer for Windows, Linux & MAC OS X to detect OS, hostname, sessions and open ports through packet sniffing or by PCAP file. Wireshark will be handy to investigate network related incident. Wireshark is a network capture and analyzer tool to see what’s happening in your network. It supports TrueCrypt, PGP, Bitlocker, Safeboot encrypted volumes. Autospy is used by thousands of users worldwide to investigate what actually happened in the computer.Įncrypted Disk Detector can be helpful to check encrypted physical drives. AutopsyĪutopsy is a GUI-based open source digital forensic program to analyze hard drives and smart phones effectively. As such, they all provide the ability to bring back in-depth information about what’s “under the hood” of a system. Whether it’s for an internal human resources case, an investigation into unauthorized access to a server, or if you just want to learn a new skill, these suites and utilities will help you conduct memory forensic analysis, hard drive forensic analysis, forensic image exploration, forensic imaging and mobile forensics. Here are some of the computer forensic investigator tools you would need. Forensic investigations are always challenging as you may gather all the information you could for the evidence and mitigation plan.

Oxygen forensics suite features