Tools and guidance
Free digital forensics tools and UK resources
Find tools for the artefact you need to examine, alongside court rules, reporting guidance and cyber standards. Each entry links to its original project or official source.
Search the directory
Search for an artefact or topic such as SRUM, Registry, Android, disclosure, STIX or expert reports. “Platforms” describes where a tool runs or how a reference is accessed; the artefact notes describe what it examines.
Open-source tools, free downloads and public guidance are labelled separately. Some standards pages provide a free overview while the full standard requires purchase. Court and regulator entries state their jurisdiction.
80 resources · links and source details checked 9 September 2026
No matching resources. Try a broader term or reset the filters.
Imaging and recovery
| Resource | Use it for | Access and scope |
|---|---|---|
| Autopsy | A graphical case workspace for examining disk images, files and artefacts with ingest modules. | Open source Windows installer; Linux/macOS need extra setup. Ingest modules differ in coverage and terms. |
| GNU ddrescue | Copies readable data from files or devices and records progress in a mapfile for controlled recovery attempts. | Open source Wrong destination selection can overwrite data; preserve the matching mapfile and assess physical faults. |
| Guymager | A graphical Linux imager offering flat, EWF and AFF image acquisition and disk cloning. | Open source AFF is not AFF4; acquisition still needs controlled device selection, write protection and verification. |
| libewf and EWF tools | Library and command-line utilities for reading, exporting and verifying supported EWF evidence images. | Open source EWF variants differ in read/write support; check the format matrix before acquisition or conversion. |
| TestDisk and PhotoRec | TestDisk investigates partition and file-system structures; PhotoRec carves supported file types from data. | Open source TestDisk can write repairs; carved files may lose names, paths or content. |
| The Sleuth Kit | Command-line tools and libraries for examining volumes, file systems and file metadata. | Open source Supported formats depend on the build and libraries; encrypted data needs separate handling. |
Windows artefacts
| Resource | Use it for | Access and scope |
|---|---|---|
| AmcacheParser | Extracts application and file records from Amcache hives. | Open source Schemas vary; an Amcache record alone does not prove execution. |
| AppCompatCacheParser | Parses Application Compatibility Cache data from Windows SYSTEM hives. | Open source ShimCache entries do not universally prove execution; interpretation depends on the Windows version. |
| Chainsaw | Searches Windows forensic artefacts and applies detection logic, including Sigma-based event-log hunting. | Open source Check field mappings and supported rules; no alerts does not mean no compromise. |
| EvtxECmd | Parses Windows event log files and applies maps to make selected event fields easier to review. | Open source Only logged, retained events are available; field maps do not establish causation. |
| Hayabusa | Builds Windows event-log timelines and applies detection rules to highlight records for review. | Open source Detections depend on rules and retained logs; alerts need investigation and corroboration. |
| JLECmd | Parses automatic and custom Windows Jump Lists. | Open source Entries can outlive targets; interpret timestamps and ordering for the particular record type. |
| LECmd | Extracts target, volume, path and timestamp information from Windows shortcut files. | Open source Target metadata can reflect an earlier state; a shortcut does not prove current file availability. |
| MFTECmd | Parses NTFS metadata, including the MFT and USN change journal, into structured output. | Open source Journal history can expire; timestamps and reason flags need context and corroboration. |
| PECmd | Parses Windows Prefetch files, including recorded run times and referenced files. | Open source Prefetch coverage varies; referenced files do not prove that someone opened their contents. |
| RECmd | Queries Registry hives and runs batch definitions against selected keys and values. | Open source Preserve transaction logs and select suitable batch definitions; Registry presence does not establish intent. |
| SrumECmd | Parses the SRUM database, with optional SOFTWARE-hive enrichment. | Open source Dirty databases may need recovery on a copy; usage totals do not prove exfiltration. |
Timeline and triage
| Resource | Use it for | Access and scope |
|---|---|---|
| Dissect | A Python framework that presents supported evidence containers, file systems and artefacts through common query and shell tools. | Open source Container, file-system and plugin coverage differ; validate the combination used. |
| Microsoft Sysinternals | Utilities for inspecting processes, persistence, file access and other Windows activity. | Free proprietary tool Live tools can change state; Sysmon cannot reconstruct logs that were never collected. |
| osquery | Exposes operating-system information through SQL tables and scheduled queries. | Open source Historical visibility requires prior collection; many tables describe current state only. |
| Plaso | Extracts time-related events from many artefact types into a common timeline workflow. | Open source Installation depends on OS and parser dependencies; review time zones, source references and extraction errors. |
| Timesketch | A collaborative web application for searching, annotating and analysing forensic timelines. | Open source Requires server administration and imported timelines; acquisition and evidence validation remain separate. |
| UAC: Unix-like Artifacts Collector | Collects volatile and stored artefacts from supported Unix-like systems using configurable collection profiles. | Open source Live collection changes state; commands, permissions and operating-system support affect coverage. |
| Velociraptor | Collects and queries endpoint artefacts using VQL, with standalone and centrally managed workflows. | Open source Live collection changes state; review collection artefacts, command execution and permissions before use. |
Memory
| Resource | Use it for | Access and scope |
|---|---|---|
| AVML | A portable user-space tool for acquiring volatile memory on Linux. | Open source Requires privileges and a supported memory source; kernel lockdown can prevent capture. |
| MemProcFS | Presents supported memory data as files and through analysis APIs, with forensic processing options. | Open source Backends vary; live or writable access needs control and may require additional hardware or software. |
| Volatility 3 | A Python framework for examining supported memory images with operating-system-specific plugins. | Free under custom licence Requires a suitable capture and matching symbols; plugin and operating-system coverage vary. |
Mobile and macOS
| Resource | Use it for | Access and scope |
|---|---|---|
| ALEAPP | Parses supported Android artefacts from an existing extraction and produces investigation reports. | Open source Analyses an existing extraction; it does not unlock devices or cover every application version. |
| iLEAPP | Parses supported iPhone and iPad extractions into reports and structured outputs. | Open source Requires an existing extraction; artefact coverage depends on plugins and application versions. |
| mac_apt | A plugin-based framework for extracting macOS artefacts from supported images, files and live systems. | Open source Image formats, encryption and plugins determine coverage; live use changes system state. |
Browser, email and cloud
| Resource | Use it for | Access and scope |
|---|---|---|
| Hindsight | Parses supported Chromium and Firefox browser data and organises records into a timeline. | Open source Coverage depends on browser version and profile completeness; records alone do not identify a person. |
| libpff and pffexport | Libraries and utilities for reading supported Outlook personal and offline folder files. | Open source PFF variant and file condition affect extraction; exports do not establish delivery or authorship. |
| Microsoft Extractor Suite | PowerShell collection functions for Microsoft 365 and Azure incident-response data. | Open source Tenant licensing, retention, permissions and API limits constrain collection; Microsoft services are separate. |
| rclone | A command-line utility for listing and transferring files across supported storage services. | Open source Sync/delete can change remote data; metadata coverage varies and provider charges may apply. |
Network analysis
| Resource | Use it for | Access and scope |
|---|---|---|
| Suricata | A network detection and monitoring engine with offline packet-processing and live deployment options. | Open source Rules require tuning; matches need investigation. Inline operation can affect traffic. |
| Wireshark | A packet analyser for inspecting captured traffic with protocol dissectors and display filters. | Open source Capture position and loss affect coverage; decrypting encrypted payloads requires appropriate secrets and support. |
| Zeek | A network analysis framework that generates structured logs from observed traffic. | Open source Sensor visibility, encryption, packet loss and enabled scripts determine available records. |
Detection and threat intelligence
| Resource | Use it for | Access and scope |
|---|---|---|
| capa | Identifies capabilities described by rules in supported executable files and analysis reports. | Open source Capabilities do not prove execution; packing and supported analysis formats affect results. |
| CyberChef | A recipe-based tool for decoding, transforming and inspecting data. | Open source Use an appropriate local copy for sensitive data; decoded output still needs interpretation. |
| FIRST Traffic Light Protocol 2.0 | A standard set of labels communicating how far sensitive information may be shared. | Free standard Sharing labels do not replace legal obligations, formal classification or access controls. |
| FLOSS | Extracts selected static, stack and decoded strings from supported executable files. | Open source Recovery depends on compiler, architecture and obfuscation; recovered strings require context. |
| Ghidra | A software reverse-engineering suite with disassembly, decompilation and scripting facilities. | Open source Decompiler output needs interpretation; analyse untrusted samples in a suitably isolated environment. |
| MISP | A platform for organising and sharing structured threat intelligence and related context. | Open source Requires administration, sharing controls and source assessment; feeds can have separate terms. |
| MITRE ATT&CK | A knowledge base describing observed adversary tactics and techniques across supported domains. | Free guidance Mappings aid analysis; they do not prove attribution or complete defensive coverage. |
| SigmaHQ rules | A shared collection of structured detection rules for security logs. | Free under custom licence Needs compatible backends and field mappings; tune rules and check their custom licence. |
| STIX 2.1 | A structured language for representing cyber threat intelligence objects and their relationships. | Free standard Check errata and supported profiles; the format does not establish intelligence reliability. |
| TAXII 2.1 | An application-layer protocol for exchanging cyber threat intelligence over HTTPS. | Free standard Agree authentication, permissions and implementation support; transport does not establish content reliability. |
| YARA | Matches rules against files and supported memory targets using strings and conditions. | Open source Matches are leads, not verdicts; rule quality, scan scope and rule licences matter. |
Files and metadata
| Resource | Use it for | Access and scope |
|---|---|---|
| bulk_extractor | Scans data for configured features without relying on file-system parsing, including within supported encoded or compressed content. | Open source Matches need context; prefer tested releases and check platform build requirements. |
| DB Browser for SQLite | A graphical SQLite database browser with table inspection, SQL queries and export facilities. | Open source Also edits databases; use read-only working copies and account for associated WAL files. |
| ExifTool | Reads metadata from many image, video, document and other file formats. | Open source Also writes metadata; use reading operations on preserved copies. Metadata does not prove authenticity. |
UK law and reporting
| Resource | Use it for | Access and scope |
|---|---|---|
| Civil Justice Council: instructing experts | Guidance on selecting, instructing and working with experts in civil claims. | Free guidance 2014 guidance for England and Wales; read with current rules and court orders. |
| CPR Part 35: Experts and Assessors | The civil rules governing expert evidence, including court permission and the expert's duty to assist the court. | Free guidance England and Wales civil procedure; read with PD35 and case-specific directions. |
| CPS: expert disclosure obligations | Disclosure Manual guidance addressing material generated or held by expert witnesses. | Free guidance England and Wales prosecution guidance; apply the disclosure test and case instructions. |
| CPS: Expert Evidence | CPS guidance on expert evidence, including admissibility, competence, credibility and disclosure. | Free guidance England and Wales prosecution guidance; court rules and directions remain authoritative. |
| Criminal Procedure Rules and Practice Directions | The official current collection, including Part 19 on expert evidence and the Criminal Practice Directions. | Free guidance England and Wales; use current consolidated texts and case-specific directions. |
| FSR: expert report content | Guidance on the content of expert reports in the criminal justice system. | Free guidance England and Wales criminal reports; check older references against current rules and the statutory code. |
| ICO: data protection principles | Guidance on the principles governing personal-data processing under the UK GDPR. | Free guidance The processing regime and lawful basis matter; sensitive and criminal-offence data need further consideration. |
| ICO: law enforcement processing | Guidance on Part 3 of the Data Protection Act 2018 for competent authorities and their processors handling law enforcement data. | Free guidance Part 3 depends on the controller and purpose; private investigations do not automatically qualify. |
| ICO: personal data breaches | ICO information to help assess a personal data breach and understand reporting responsibilities. | Free guidance Assess the reporting test and timescale; do not wait for a complete forensic report. |
| Northern Ireland: practice directions | The official collection of Northern Ireland judicial practice directions, including expert-evidence and case-management material. | Free guidance Northern Ireland: check each direction's scope, amendments, revocations and related court rules. |
| Practice Direction 35 | Requirements and guidance accompanying CPR Part 35, including expert report content and independence. | Free guidance England and Wales civil reports; declarations must reflect actual work and applicable requirements. |
| Scottish Courts: rules and practice | The official Scottish courts portal for rules, practice notes, directions and forms. | Free guidance Scotland: requirements differ by court and proceeding; check current rules and case directions. |
Quality and standards
| Resource | Use it for | Access and scope |
|---|---|---|
| ENISA: electronic evidence for first responders | A guide to evidence gathering aimed particularly at incident-response teams. | Free guidance 2015 process guidance; apply current technical procedures and relevant local law. |
| FSR Code of Practice: version 2 | The statutory code setting quality requirements for specified forensic science activities in the criminal justice system. | Free standard England and Wales; effective 2 October 2025. Check activity scope and applicable provisions. |
| FSR: method validation in digital forensics | Guidance on showing that a digital forensic method is suitable for its intended purpose and identifying its limitations. | Free guidance Read alongside the current code; validation is specific to the method and intended use. |
| ISO/IEC 17025: public summary | The public overview of requirements for competent, impartial and consistent testing and calibration laboratories. | Free summary; paid standard The full standard is paid; tool use does not confer laboratory accreditation. |
| ISO/IEC 27037: public summary | The public summary of guidance on identifying, collecting, acquiring and preserving digital evidence. | Free summary; paid standard The free summary is not the full standard and cannot establish compliance. |
| NCSC: incident management | Guidance on building and maintaining the capability to detect, respond to and resolve cyber incidents. | Free guidance Adapt roles and procedures to the organisation; guidance does not provide investigative authority. |
| NCSC: logging for security purposes | Guidance on choosing, collecting and protecting logs that can answer incident questions. | Free guidance Collection must precede analysis; useful fields and retention depend on the environment. |
| NIST Computer Forensics Tool Testing | NIST's programme for developing forensic tool test methods, specifications and reports. | Free guidance Results apply to stated versions, configurations and tests; reports are not blanket certification. |
| NIST Cybersecurity Framework 2.0 | A framework for describing and organising cybersecurity outcomes across six functions. | Free guidance An outcomes framework; it does not prescribe one implementation or confer certification. |
| NIST SP 800-61 Rev. 3: incident response | Recommendations for incorporating incident response throughout cybersecurity risk management using CSF 2.0. | Free guidance April 2025 revision replacing Rev. 2; a risk-management reference, not an acquisition manual. |
| NIST SP 800-86: forensic techniques in incident response | A foundational guide to integrating computer and network forensic techniques into IT incident response. | Free guidance Foundational 2006 IT guidance; technical examples are dated and it is not UK legal procedure. |
Training and reference
| Resource | Use it for | Access and scope |
|---|---|---|
| DFRWS forensic challenges | Research challenges with evidence material and published approaches across different forensic problems. | Free training Prerequisites, age and reuse terms differ; findings and solutions are dataset-specific. |
| Digital Corpora | A collection of digital forensic datasets and scenarios for research, education and testing. | Free training Check the selected corpus's provenance, reuse terms, content notices and download size. |
| ForensicArtifacts definitions | Machine-readable definitions describing forensic artefacts and where to look for them. | Open source Source definitions do not guarantee artefact presence or correct parsing by a collecting tool. |
| Microsoft: NTFS change journal records | Explains what change journal records represent, including reason flags and the coalescing of changes. | Free guidance Records can expire or combine changes; the journal does not preserve file contents. |
| Microsoft: Windows Event Log | Documentation for the modern Windows Event Log system and its interfaces. | Free guidance Interpret events using provider definitions and system context, not event IDs alone. |
| NIST CFReDS | A portal of documented forensic datasets for training and testing, including NIST and contributed material. | Free training Check each dataset's age, coverage and terms; exercise success does not validate every case. |
Check the tool and its results
Record the tool version and settings, preserve the source, and check important findings against the underlying records. Follow the current court directions and the guidance that applies to your jurisdiction.
For an explanation of the evidence behind these tools, see the artefacts and forensic tools guide or look up an unfamiliar term in the digital forensics glossary. The Acorn app directory shows related investigation workflows.
Check the linked source for current licence terms, dependencies and project updates before use.