A list of free and open forensics analysis tools and other resources

Collaborative Incident Response platform

macOS forensic acquisition made simple

macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR

A collection of PowerShell scripts for analyzing macOS Forensic Artifacts

C# Library and research notes for Windows 11 Notepad State Files

Neural network RDP cache reconstruction tool

Automatically create iSCSI targets for all drives except for a boot device

Is a portable forensic tool for analyzing Windows logs, pre-organized according to the methodology outlined in this job: https://cybersecuritynews.com/windows-event-log-analysis/, to quickly highlight key forensic artifacts.

Digital Forensics Essentials (DFE)

VMDetect is a Python based Windows VM detection and environment forensics tool that reads ACPI/SMBIOS firmware tables and system artifacts to expose virtual machines, even if people try to hide them!

Collect digital evidence in one place.Disk, RAM, and Android acquisition.

Reverse Engineering the Tabstate files for Windows Notepad

Decryption tool for LockMyPix android app

DFLER: Drone Flight Log Entity Recognizer to Support Forensic Investigation on Drone Device

Valhuntir SIFT platform — MCP servers, gateway, Examiner Portal

Linux last-logon forensic auditing from the binary lastlog database.

A zero-dependency, open-source CLI tool for digital forensics and backups. Built for security researchers and sysadmins to streamline data extraction, metadata analysis, and rapid file recovery.

A tool that detects files and directories that may be hidden by trojan and rootkits on Unix platforms