RegRipper - includes rip, ripXP, and regslack SSDeep - fuzzy hashing is also incorporated into VirusTotal MD5Deep - also allows for other hashing algorithms Intella - from Vound Software doesn't require that Outlook be installed trial available PDF Tools - from Didier Stevens some of Didier's tools have been incorporated into the VirusTotal siteĮmailchemy - from Weird Kid Software demo available Office 2007 document metadata (script) - look for cat_open_xml.pl other tools available, as well Structured Storage Extractor - view contents of structured storage/OLE files this used to mean just MS Office (pre-2007) documents, but on Windows 7, this now means Sticky Notes, etc. Internet Evidence Finder (JADSoftware) - also, check out the Encrypted Disk DetectorĭiskDigger - from Dmitry Brant also check out NTFSWalker Timeline Creation Tools (TSK tools, pasco, Perl scripts, etc.) - Perl scripts available from the Win4n6 Yahoo Group ProDiscover, Basic Edition - Not a full suite, but very usefulĪntiVirus Scanners ( ClamWinPortable, SysClean, Malwarebytes) TSK Tools - I've used mmls and fls mostly, but blkls is extremely useful, as well

P2Explorer - from Paraben free, requires registration IMDisk - great free tool for mounting Windows images on Windows systems, in read-only mode Raptor - bootable Linux CD that can be used for imaging (this will likely open up a whole flurry of similar emails, so let's just use this one as a placeholder for all bootable Linux CDs.)

Also great for selected file extraction from the image, when you don't need everythingĭcfldd - another CLI imaging tool, available for the Windows platform vmdk files, etc - even allows you to 'acquire' other formats to raw/dd. Perl - 'nuff said mostly for creating my own toolsįTK Imager - great for opening raw (ie, dd) images. I'll start by providing tools that I use, as well as links to other tools, and from there, I will expand the list as I receive information (ie, comments, emails, etc.) Regardless, I thought that this would be a good way to start and even maintain a list of free tools (or at least some that have trials/demos available) that can/have been used during computer forensic examinations on Windows systems. In my mind, that kind of defeats the purpose of the listserv.why not just close it down and move everyone to Craigslist? I've seen requests in several listservs for listings of free tools that people use during examinations, and most often, the response is something akin to 'contact me off list'.

Prodiscover basic download 64 bit