Anti-Forensics Field Manual

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Forensic Tools ======

===== Definition =====
This directory collects the forensic tools, parsers, acquisition utilities, timeline systems, malware-analysis environments, cloud helpers, and native references used across the wiki.
A tool can parse evidence, organize evidence, and sometimes rescue evidence from cold sectors. It still cannot understand the case for you.

===== Tool Categories =====

===== Core =====
  * [[https://www.autopsy.com/|Autopsy]] - Case review, file-system browsing, timelines, term search, and recovered artifact review.
  * [[https://www.sleuthkit.org/sleuthkit/|The Sleuth Kit]] - Command-line file-system analysis and evidence inspection.
  * [[https://www.exterro.com/ftk-product-downloads|FTK Imager]] - Forensic imaging, preview, and export workflows.
  * [[https://guymager.sourceforge.io/|Guymager]] - Linux forensic imaging with hashing and acquisition logs.
  * [[https://sourceforge.net/projects/dc3dd/|dc3dd]] - Disk imaging and hashing utility.
  * [[https://www.gnu.org/software/ddrescue/|GNU ddrescue]] - Imaging damaged media while preserving recovery logs.
  * [[https://arsenalrecon.com/products/arsenal-image-mounter|Arsenal Image Mounter]] - Mount forensic images for controlled review.
  * [[https://www.magnetforensics.com/products/magnet-axiom/|Magnet AXIOM]] - Commercial forensic suite for computer, mobile, and cloud evidence review.
  * [[https://belkasoft.com/x|Belkasoft X]] - Commercial forensic suite for computers, mobile devices, and cloud artifacts.
  * [[https://www.x-ways.net/forensics/|X-Ways Forensics]] - Commercial forensic suite for file systems, carving, and case analysis.
  * [[https://www.osforensics.com/|OSForensics]] - Host artifact review and case analysis suite.
  * [[https://exiftool.org/|ExifTool]] - Metadata extraction across images, documents, and many file formats.
  * [[https://github.com/simsong/bulk_extractor|bulk_extractor]] - Feature extraction from disk images without relying on file-system allocation.
  * [[https://www.cgsecurity.org/|PhotoRec and TestDisk]] - File recovery and partition recovery utilities.
  * [[https://foremost.sourceforge.net/|Foremost]] - File carving by headers, footers, and simple signatures.
  * [[https://github.com/sleuthkit/scalpel|Scalpel]] - Configurable file carving utility.
  * [[https://github.com/jessek/hashdeep|hashdeep]] - Recursive hashing, audit, and hash-set comparison.
  * [[https://github.com/log2timeline/dfvfs|dfVFS]] - Virtual file-system abstraction used by forensic tools.
  * [[https://github.com/libyal/libewf|libewf]] - Expert Witness Format image support library.
  * [[https://github.com/libyal/libvshadow|libvshadow]] - Volume Shadow Copy parsing library.
  * [[https://github.com/libyal/libfsntfs|libfsntfs]] - NTFS file-system parsing library.

===== Timeline =====
  * [[https://github.com/log2timeline/plaso|Plaso]] - Timeline extraction and normalization across many artifact types.
  * [[https://github.com/google/timesketch|Timesketch]] - Collaborative timeline analysis and event tagging.
  * [[https://github.com/log2timeline/dfdatetime|dfDateTime]] - Timestamp conversion and interpretation support.
  * [[https://gchq.github.io/CyberChef/|CyberChef]] - Timestamp conversion, decoding, and quick data transformations.
  * [[https://jqlang.org/|jq]] - JSON parsing for logs, exports, and cloud evidence.
  * [[https://github.com/mikefarah/yq|yq]] - YAML, JSON, XML, and properties parsing during evidence review.

===== Windows =====
  * [[https://ericzimmerman.github.io/#!index.md|Eric Zimmerman's Tools]] - Windows artifact parsers including MFTECmd, PECmd, EvtxECmd, and others.
  * [[https://www.sans.org/tools/kape|KAPE]] - Targeted artifact collection and processing.
  * [[https://learn.microsoft.com/en-us/sysinternals/|Sysinternals Suite]] - Microsoft Windows internals and triage tools.
  * [[https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns|Autoruns]] - Persistence and autorun location review.
  * [[https://learn.microsoft.com/en-us/sysinternals/downloads/procmon|Process Monitor]] - Process, registry, and file activity observation.
  * [[https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon|Sysmon]] - High-fidelity Windows endpoint telemetry.
  * [[https://github.com/keydet89/RegRipper3.0|RegRipper]] - Registry parsing framework and plugins.
  * [[https://github.com/Yamato-Security/hayabusa|Hayabusa]] - Windows event log hunting and timeline support.
  * [[https://github.com/WithSecureLabs/chainsaw|Chainsaw]] - Windows event log search and detection.
  * [[https://github.com/wagga40/Zircolite|Zircolite]] - Sigma-based event log scanning.
  * [[https://eventlogxp.com/|Event Log Explorer]] - Windows event log viewing and filtering.
  * [[https://learn.microsoft.com/en-us/powershell/|PowerShell]] - Native Windows automation and log review context.
  * [[https://github.com/williballenthin/EVTXtract|EVTXtract]] - Carving and recovering EVTX event log fragments.
  * [[https://learn.microsoft.com/en-us/sysinternals/downloads/procdump|ProcDump]] - Process dump collection for troubleshooting and memory review.
  * [[https://learn.microsoft.com/en-us/sysinternals/downloads/tcpview|TCPView]] - Windows network connection visibility.
  * [[https://github.com/Invoke-IR/PowerForensics|PowerForensics]] - PowerShell forensic artifact access and parsing.
  * [[https://github.com/davehull/Kansa|Kansa]] - PowerShell-based incident response collection framework.
  * [[https://github.com/log2timeline/dfwinreg|dfWinReg]] - Windows Registry parsing support library.

===== Linux Macos =====
  * [[https://www.osquery.io/|osquery]] - Structured endpoint state collection across operating systems.
  * [[https://www.sans.org/tools/sift-workstation/|SIFT Workstation]] - DFIR workstation distribution and toolset.
  * [[https://github.com/ydkhatri/mac_apt|mac_apt]] - macOS artifact parsing and reporting.
  * [[https://github.com/mac4n6/APOLLO|APOLLO]] - SQLite query framework for Apple artifacts.
  * [[https://github.com/libyal/libyal|libyal]] - Forensic libraries for many evidence formats.
  * [[https://docs.velociraptor.app/|Velociraptor]] - Endpoint collection, hunting, and artifact triage.

===== Browser Mobile Cloud =====
  * [[https://sqlitebrowser.org/|DB Browser for SQLite]] - Manual SQLite database review for browser and app artifacts.
  * [[https://www.sqlite.org/index.html|SQLite]] - Reference documentation for SQLite databases used by many applications.
  * [[https://www.foxtonforensics.com/browser-history-capturer/|Browser History Capturer]] - Browser history acquisition support.
  * [[https://www.foxtonforensics.com/browser-history-examiner/|Browser History Examiner]] - Browser artifact review support.
  * [[https://developer.android.com/tools/releases/platform-tools|ADB Platform Tools]] - Android device communication and collection support.
  * [[https://libimobiledevice.org/|libimobiledevice]] - Open tooling for iOS device interactions.
  * [[https://github.com/abrignoni/iLEAPP|iLEAPP]] - iOS artifact parsing and report generation.
  * [[https://github.com/abrignoni/ALEAPP|ALEAPP]] - Android artifact parsing and report generation.
  * [[https://github.com/mvt-project/mvt|Mobile Verification Toolkit]] - Mobile compromise indicator checks and extraction support.
  * [[https://cellebrite.com/en/ufed/|Cellebrite UFED]] - Commercial mobile device extraction platform.
  * [[https://www.oxygen-forensic.com/en/products/oxygen-forensic-detective|Oxygen Forensic Detective]] - Commercial mobile and cloud forensic suite.
  * [[https://www.msab.com/products/xry/|MSAB XRY]] - Commercial mobile extraction and analysis platform.
  * [[https://www.elcomsoft.com/eppb.html|Elcomsoft Phone Breaker]] - Mobile and cloud acquisition support where authorized.
  * [[https://github.com/MobSF/Mobile-Security-Framework-MobSF|MobSF]] - Mobile application security and artifact analysis framework.
  * [[https://github.com/skylot/jadx|jadx]] - Android APK decompiler for application review.
  * [[https://apktool.org/|Apktool]] - Android APK reverse engineering and resource inspection.
  * [[https://frida.re/|Frida]] - Dynamic instrumentation framework for authorized app and malware analysis.
  * [[https://rclone.org/|Rclone]] - Cloud storage listing and collection support where authorized.
  * [[https://learn.microsoft.com/en-us/powershell/microsoftgraph/|Microsoft Graph PowerShell]] - Microsoft cloud audit and account data access where authorized.

===== Network Ir =====
  * [[https://www.wireshark.org/|Wireshark]] - Packet capture and protocol review.
  * [[https://zeek.org/|Zeek]] - Network security monitoring logs.
  * [[https://suricata.io/|Suricata]] - Network detection and packet inspection.
  * [[https://www.netresec.com/?page=NetworkMiner|NetworkMiner]] - Network forensic artifact extraction.
  * [[https://arkime.com/|Arkime]] - Full-packet capture indexing and search.
  * [[https://github.com/google/grr|GRR Rapid Response]] - Remote live response and collection.
  * [[https://github.com/DFIR-ORC/dfir-orc|DFIR ORC]] - Enterprise-scale Windows collection.
  * [[https://github.com/fox-it/dissect|Dissect]] - Forensic parsing framework for disks, images, and host artifacts.
  * [[https://wazuh.com/|Wazuh]] - Endpoint security monitoring and alert context.
  * [[https://www.misp-project.org/|MISP]] - Threat intelligence and indicator sharing platform.
  * [[https://thehive-project.org/|TheHive]] - Incident response case management platform.

===== Memory Malware =====
  * [[https://github.com/volatilityfoundation/volatility3|Volatility 3]] - Memory analysis and plugin-driven investigation.
  * [[https://github.com/Velocidex/WinPmem|WinPmem]] - Windows memory acquisition.
  * [[https://github.com/504ensicsLabs/LiME|LiME]] - Linux memory acquisition.
  * [[https://github.com/microsoft/avml|AVML]] - Linux memory acquisition for cloud and endpoint response.
  * [[https://github.com/ufrisk/MemProcFS|MemProcFS]] - Memory analysis through a virtual file-system interface.
  * [[https://remnux.org/|REMnux]] - Linux malware analysis environment.
  * [[https://github.com/mandiant/flare-vm|FLARE-VM]] - Windows malware analysis toolkit.
  * [[https://ghidra-sre.org/|Ghidra]] - Reverse engineering suite.
  * [[https://rada.re/n/|radare2]] - Reverse engineering framework.
  * [[https://x64dbg.com/|x64dbg]] - Windows debugger for malware analysis.
  * [[https://virustotal.github.io/yara/|YARA]] - Pattern matching for malware triage.
  * [[https://github.com/mandiant/capa|capa]] - Capability detection for executable analysis.
  * [[https://github.com/mandiant/flare-floss|FLOSS]] - String decoding and extraction for malware analysis.
  * [[https://github.com/horsicq/Detect-It-Easy|Detect It Easy]] - File type, compiler, and packer identification.
  * [[https://github.com/decalage2/oletools|oletools]] - Microsoft Office document analysis utilities.
  * [[https://github.com/erocarrera/pefile|pefile]] - Portable Executable parsing.
  * [[https://lief.re/|LIEF]] - Executable format parsing and instrumentation.
  * [[https://github.com/dnSpyEx/dnSpy|dnSpyEx]] - .NET assembly inspection and debugging.
  * [[https://github.com/kevoreilly/CAPEv2|CAPE Sandbox]] - Malware sandbox analysis platform.
  * [[https://github.com/MobSF/Mobile-Security-Framework-MobSF|MobSF]] - Mobile application security and artifact analysis framework.
  * [[https://github.com/skylot/jadx|jadx]] - Android APK decompiler for application review.
  * [[https://apktool.org/|Apktool]] - Android APK reverse engineering and resource inspection.
  * [[https://frida.re/|Frida]] - Dynamic instrumentation framework for authorized app and malware analysis.
  * [[https://sigmahq.io/|Sigma]] - Detection rule format for investigative hunting.

===== Privacy Encryption =====
  * [[https://www.veracrypt.fr/en/Home.html|VeraCrypt]] - Reference point for encrypted container behavior.
  * [[https://www.7-zip.org/|7-Zip]] - Archive and encryption utility often encountered in cases.
  * [[https://keepass.info/|KeePass]] - Password manager reference point.
  * [[https://cryptomator.org/|Cryptomator]] - Client-side encrypted storage reference point.
  * [[https://www.torproject.org/download/|Tor Browser]] - Reference point for privacy-browser artifacts.
  * [[https://tails.net/|Tails]] - Privacy-focused operating system reference point.

===== Project Resources =====
  * [[https://github.com/Anti-Forensics/|Anti-Forensics GitHub organization]]
  * [[wiki:resources:start|Project Resources]]
  * [[wiki:support|Support Anti-Forensics.com]]

===== Use Notes =====
This article is for defensive education and technical reference. It should not be treated as legal, forensic, investigative, compliance, or operational advice without qualified professional judgment.