Forensicswiki.org has moved to this site, forensicswiki.xyz. For information, please join the Google Group forensicswiki-reborn
Difference between revisions of "Tools"
Jump to navigation
Jump to search
imported>Eriknorthrop |
|||
(46 intermediate revisions by 19 users not shown) | |||
Line 16: | Line 16: | ||
= Disk Analysis Tools = | = Disk Analysis Tools = | ||
== Hard Drive Firmware and Diagnostics Tools == | == Hard Drive Firmware and Diagnostics Tools == | ||
− | ; [[PC-3000]] from [[ | + | ; [[PC-3000]] from [[ACE Lab]] |
− | : http://www. | + | : http://www.acelaboratory.com/catalog/ |
− | |||
== Linux-based Tools == | == Linux-based Tools == | ||
Line 31: | Line 30: | ||
== Macintosh-based Tools == | == Macintosh-based Tools == | ||
+ | |||
+ | ; [[Elcomsoft Mobile Forensic Bundle]] by [[Elcomsoft]] | ||
+ | : https://www.elcomsoft.com/emfb.html | ||
+ | : The Bundle includes macOS editions of Elcomsoft forensic tools for mobile and cloud data extraction. | ||
; [[Macintosh Forensic Software]] by [[BlackBag Technologies, Inc.]] | ; [[Macintosh Forensic Software]] by [[BlackBag Technologies, Inc.]] | ||
Line 40: | Line 43: | ||
; [[Mac Marshal]] by [[ATC-NY]] | ; [[Mac Marshal]] by [[ATC-NY]] | ||
: http://www.macmarshal.com/ | : http://www.macmarshal.com/ | ||
+ | |||
+ | ; [[Recon for MAC OS X]] by [[Sumuri, LLC]] | ||
+ | : https://www.sumuri.com/products/recon/ | ||
== Windows-based Tools == | == Windows-based Tools == | ||
+ | |||
+ | ; Arsenal Recon Weapons by [[Arsenal Recon]] | ||
+ | ; https://ArsenalRecon.com/ | ||
+ | : Arsenal Recon offers unique and powerful tools to mount Windows disk images, reconstruct Windows Registries, and process Windows hibernation files. | ||
+ | |||
+ | ; Belkasoft Acquisition Tool by [[Belkasoft]] | ||
+ | ; https://belkasoft.com/bat | ||
+ | : BAT is a free utility to acquire a wide range of data sources: hard drives, running computers RAM memory, modern smartphones, and various types of clouds. The output can be analyzed with both Belkasoft and third-party tools. | ||
+ | |||
+ | ; Belkasoft Evidence Center by [[Belkasoft]] | ||
+ | ; https://belkasoft.com/ec | ||
+ | : BEC allows an investigator to perform all investigation steps: acquisition (aquire hard and removable drives, image smartphones and download cloud data), extraction of evidence (searches and carves more than 700 formats of various files and applications data), analysis (hex viewer, SQLite viewer, social graph building with communities detection etc) and reporting. | ||
; [[Blackthorn GPS Forensics]] | ; [[Blackthorn GPS Forensics]] | ||
Line 48: | Line 66: | ||
; [[BringBack]] by [[Tech Assist, Inc.]] | ; [[BringBack]] by [[Tech Assist, Inc.]] | ||
: http://www.toolsthatwork.com/bringback.htm | : http://www.toolsthatwork.com/bringback.htm | ||
− | |||
− | |||
− | |||
− | |||
; [[CD/DVD Inspector]] by [[InfinaDyne]] | ; [[CD/DVD Inspector]] by [[InfinaDyne]] | ||
Line 59: | Line 73: | ||
; [[EMail Detective - Forensic Software Tool]] by [[Hot Pepper Technology, Inc]] | ; [[EMail Detective - Forensic Software Tool]] by [[Hot Pepper Technology, Inc]] | ||
; http://www.hotpepperinc.com/emd | ; http://www.hotpepperinc.com/emd | ||
+ | |||
+ | ; [[Elcomsoft Desktop Forensic Bundle]] by [[Elcomsoft]] | ||
+ | : https://www.elcomsoft.com/edfb.html | ||
+ | : All password recovery tools for unlocking documents, decrypting archives and crypto containers. | ||
+ | |||
+ | ; [[Elcomsoft Premium Forensic Bundle]] by [[Elcomsoft]] | ||
+ | : https://www.elcomsoft.com/epfb.html | ||
+ | : A pack of every forensic tool of Elcomsoft for data extraction from mobile devices, unlocking documents, decrypting archives, breaking into encrypted containers, viewing and analyzing evidence. | ||
; [[EnCase]] by [[Guidance Software]] | ; [[EnCase]] by [[Guidance Software]] | ||
: http://www.guidancesoftware.com/ | : http://www.guidancesoftware.com/ | ||
+ | |||
+ | ; Facebook Forensic Toolkit (FFT) by [[Afentis_forensics]] | ||
+ | ; http://www.facebookforensics.com | ||
+ | : eDiscovery toolkit to identify and clone full profiles; including wall posts, private messages, uploaded photos/tags, group details, graphically illustrate friend links, and generate expert reports. | ||
+ | |||
+ | ; [[Forensic Explorer]] ([[FEX]]) by [[GetData Forensics]] | ||
+ | : http://www.forensicexplorer.com | ||
; [[Forensic Toolkit]] ([[FTK]]) by [[AccessData]] | ; [[Forensic Toolkit]] ([[FTK]]) by [[AccessData]] | ||
Line 71: | Line 100: | ||
; [[ILook Investigator]] by [[Elliot Spencer]] and [[Internal Revenue Service|U.S. Dept of Treasury, Internal Revenue Service - Criminal Investigation]] (IRS) | ; [[ILook Investigator]] by [[Elliot Spencer]] and [[Internal Revenue Service|U.S. Dept of Treasury, Internal Revenue Service - Criminal Investigation]] (IRS) | ||
: http://www.ilook-forensics.org/ | : http://www.ilook-forensics.org/ | ||
+ | |||
+ | ; [[Internet Evidence Finder]] ([[IEF]]) by [[Magnet Forensics]] | ||
+ | : http://www.magnetforensics.com/ | ||
; [[Mercury Indexer]] by [[MicroForensics, Inc.]] | ; [[Mercury Indexer]] by [[MicroForensics, Inc.]] | ||
Line 124: | Line 156: | ||
: Hardware based acquisition of memory on a locked computer via [http://www.windowsscope.com/index.php?page=shop.product_details&flypage=flypage.tpl&product_id=30&category_id=1&option=com_virtuemart&Itemid=34 CaptureGUARD Gateway] | : Hardware based acquisition of memory on a locked computer via [http://www.windowsscope.com/index.php?page=shop.product_details&flypage=flypage.tpl&product_id=30&category_id=1&option=com_virtuemart&Itemid=34 CaptureGUARD Gateway] | ||
: [http://www.windowsscope.com WindowsSCOPE] Live provides memory analysis of Windows computers on a network from Android phones and tablets. | : [http://www.windowsscope.com WindowsSCOPE] Live provides memory analysis of Windows computers on a network from Android phones and tablets. | ||
+ | |||
+ | ; [[MailXaminer]] by [[SysTools]] | ||
+ | : http://www.mailxaminer.com/ | ||
+ | : Forensic & eDiscovery Tool to find digital email evidences from multiple email platform through its powerful Search mechanism. | ||
+ | |||
+ | ; Twitter Forensic Toolkit (TFT) by [[Afentis_forensics]] | ||
+ | ; http://www.twitterforensics.com | ||
+ | : eDiscovery toolkit to identify relevant Tweets, clone full profiles, download all tweets/media, data mine across comments, and generate expert reports. | ||
+ | |||
+ | ; YouTube Forensic Toolkit (YFT) by [[Afentis_forensics]] | ||
+ | ; http://www.youtubeforensics.com | ||
+ | : eDiscovery toolkit to identify relevant online media, download/convert videos, data mine across comments, and generate expert reports. | ||
== Open Source Tools == | == Open Source Tools == | ||
Line 161: | Line 205: | ||
; [[Hachoir]] | ; [[Hachoir]] | ||
: A generic framework for binary file manipulation, it supports [[FAT12]], [[FAT16]], [[FAT32]], [[ext2|ext2/ext3]], Linux swap, MSDOS partition header, etc. Recognize file type. Able to find subfiles (hachoir-subfile). | : A generic framework for binary file manipulation, it supports [[FAT12]], [[FAT16]], [[FAT32]], [[ext2|ext2/ext3]], Linux swap, MSDOS partition header, etc. Recognize file type. Able to find subfiles (hachoir-subfile). | ||
+ | |||
+ | ; [[hashdb]] | ||
+ | : http://github.com/simsong/hashdb/wiki | ||
+ | : A tool for finding previously identified blocks of data in media such as disk images. | ||
+ | |||
+ | ; [[IPED]] | ||
+ | : https://github.com/lfcnassif/IPED | ||
+ | : An open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners. | ||
; [[magicrescue]] | ; [[magicrescue]] | ||
Line 194: | Line 246: | ||
; [[P2 Enterprise Edition]] by [[Paraben]] | ; [[P2 Enterprise Edition]] by [[Paraben]] | ||
: http://www.paraben-forensics.com/enterprise_forensics.html | : http://www.paraben-forensics.com/enterprise_forensics.html | ||
+ | |||
+ | ; [[Elcomsoft Premium Forensic Bundle]] by [[Elcomsoft]] | ||
+ | : https://www.elcomsoft.com/epfb.html | ||
= Forensics Live CDs = | = Forensics Live CDs = | ||
Line 204: | Line 259: | ||
; [[BackTrack Linux]] | ; [[BackTrack Linux]] | ||
: [http://www.backtrack-linux.org/ http://www.backtrack-linux.org/] | : [http://www.backtrack-linux.org/ http://www.backtrack-linux.org/] | ||
+ | |||
+ | ; [[Paladin Forensic Suite - Live Boot Ubuntu]] ([[Sumuri, LLC]]) | ||
+ | : https://www.sumuri.com/products/paladin/ | ||
+ | : Simplifies various forensics tasks in a forensically sound manner via the PALADIN Toolbox. | ||
See: [[:Category:Live CD|Forensics Live CDs]] | See: [[:Category:Live CD|Forensics Live CDs]] | ||
Line 222: | Line 281: | ||
== Cell Phone Forensics == | == Cell Phone Forensics == | ||
+ | ; [https://belkasoft.com/ec Belkasoft Evidence Center] | ||
; [[BitPIM]] | ; [[BitPIM]] | ||
; [[Cellebrite UFED]] | ; [[Cellebrite UFED]] | ||
; [[DataPilot Secure View]] | ; [[DataPilot Secure View]] | ||
+ | ; [[Elcomsoft Mobile Forensic Bundle]] | ||
; [[.XRY]] | ; [[.XRY]] | ||
: http://www.msab.com/index | : http://www.msab.com/index | ||
Line 251: | Line 312: | ||
= Other Tools = | = Other Tools = | ||
+ | |||
; Chat Sniper | ; Chat Sniper | ||
: http://www.alexbarnett.com/chatsniper.htm | : http://www.alexbarnett.com/chatsniper.htm | ||
: A forensic software tool designed to simplify the process of on-scene evidence acquisition and analysis of logs and data left by the use of AOL, MSN (Live), or Yahoo instant messenger. | : A forensic software tool designed to simplify the process of on-scene evidence acquisition and analysis of logs and data left by the use of AOL, MSN (Live), or Yahoo instant messenger. | ||
+ | |||
+ | ; Serial Port Analyzer | ||
+ | : http://www.eltima.com/how-to-analyze-serial-port-activity/ | ||
+ | : The tool to analyze serial port and device activity. | ||
; Computer Forensics Toolkit | ; Computer Forensics Toolkit | ||
Line 266: | Line 332: | ||
: http://www.parallels.com/ | : http://www.parallels.com/ | ||
: http://en.wikipedia.org/wiki/Parallels_Workstation | : http://en.wikipedia.org/wiki/Parallels_Workstation | ||
+ | |||
+ | ; Serial and USB ports sharing | ||
+ | : http://www.flexihub.com/serial-over-ethernet.html | ||
+ | : Share and access serial and USB ports over Ethernet | ||
; Microsoft Virtual PC | ; Microsoft Virtual PC | ||
Line 283: | Line 353: | ||
: http://www.forensictracer.com | : http://www.forensictracer.com | ||
: Software for forensic analysis of internet resources (IP address, e-mail address, domain name, URL, e-mail headers, log files...) | : Software for forensic analysis of internet resources (IP address, e-mail address, domain name, URL, e-mail headers, log files...) | ||
+ | |||
+ | ; Recon for MAC OS X | ||
+ | : https://www.sumuri.com/products/recon/ | ||
+ | : RECON for Mac OS X is simply the fastest way to conduct Mac Forensics, automates what an experienced examiner would need weeks to accomplish in minutes, now includes PALADIN 6 which comes with a full featured Forensic Suite, bootable forensic imager, a software write-blocker and so much more. | ||
+ | |||
== Hex Editors == | == Hex Editors == | ||
Line 288: | Line 363: | ||
; [[biew]] | ; [[biew]] | ||
: http://biew.sourceforge.net/en/biew.html | : http://biew.sourceforge.net/en/biew.html | ||
+ | |||
+ | ; [[bless]] | ||
+ | : http://home.gna.org/bless/ | ||
; [[Okteta]] | ; [[Okteta]] | ||
Line 306: | Line 384: | ||
; [[khexedit]] | ; [[khexedit]] | ||
: http://docs.kde.org/stable/en/kdeutils/khexedit/index.html | : http://docs.kde.org/stable/en/kdeutils/khexedit/index.html | ||
+ | |||
+ | ; ReclaiMe Pro | ||
+ | : The built-in disk editor visualizes most known partition and filesystem objects: boot sectors, superblocks, partition headers in structured view. Low-level data editing for extra leverage. | ||
+ | : http://www.ReclaiMe-Pro.com | ||
; [[WinHex]] | ; [[WinHex]] | ||
Line 327: | Line 409: | ||
:http://www.sandstorm.net/products/phonesweep/ | :http://www.sandstorm.net/products/phonesweep/ | ||
:PhoneSweep is a commercial grade multi-line wardialer used by many security auditors to run telephone line scans in their organizations. PhoneSweep Gold is the distributed-access add-on for PhoneSweep, for organizations that need to run scans remotely. | :PhoneSweep is a commercial grade multi-line wardialer used by many security auditors to run telephone line scans in their organizations. PhoneSweep Gold is the distributed-access add-on for PhoneSweep, for organizations that need to run scans remotely. | ||
+ | |||
+ | ;TeleSweep | ||
+ | :http://www.securelogix.com/modemscanner/ | ||
+ | :SecureLogix is currently offering no-cost downloads of our award-winning TeleSweep Secure® modem-vulnerability scanner. This free modem scanning software can be used to dial a batch of corporate phone numbers and report on the number of modems connected to these corporate lines. *** Registration is required for obtaining a license key *** Still free however. | ||
+ | |||
+ | ;WarVox | ||
+ | :https://github.com/rapid7/warvox | ||
+ | :WarVOX is a free, open-source VOIP-based war dialing tool for exploring, classifying, and auditing phone systems. | ||
+ | |||
+ | ;Additional Software Names and Links (Jackpot!) | ||
+ | :http://www.wyae.de/software/paw/ |
Latest revision as of 04:39, 20 May 2020
This is an overview of available tools for forensic investigators. Please click on the name of any tool for more details.
Note: This page has gotten too big and is being broken up. See:
- Category:Disk Imaging
- Tools:Data Recovery (including file carving)
- Tools:File Analysis
- Tools:Document Metadata Extraction
- Tools:Memory Imaging
- Tools:Memory Analysis
- Tools:Network Forensics
- Tools:Logfile Analysis
- Category:Anti-forensics tools
- Category:Secure deletion
Contents
Disk Analysis Tools
Hard Drive Firmware and Diagnostics Tools
Linux-based Tools
Macintosh-based Tools
- Elcomsoft Mobile Forensic Bundle by Elcomsoft
- https://www.elcomsoft.com/emfb.html
- The Bundle includes macOS editions of Elcomsoft forensic tools for mobile and cloud data extraction.
- Macintosh Forensic Software by BlackBag Technologies, Inc.
- http://www.blackbagtech.com/software_mfs.html
Windows-based Tools
- Arsenal Recon Weapons by Arsenal Recon
- https://ArsenalRecon.com/
- Arsenal Recon offers unique and powerful tools to mount Windows disk images, reconstruct Windows Registries, and process Windows hibernation files.
- Belkasoft Acquisition Tool by Belkasoft
- https://belkasoft.com/bat
- BAT is a free utility to acquire a wide range of data sources: hard drives, running computers RAM memory, modern smartphones, and various types of clouds. The output can be analyzed with both Belkasoft and third-party tools.
- Belkasoft Evidence Center by Belkasoft
- https://belkasoft.com/ec
- BEC allows an investigator to perform all investigation steps: acquisition (aquire hard and removable drives, image smartphones and download cloud data), extraction of evidence (searches and carves more than 700 formats of various files and applications data), analysis (hex viewer, SQLite viewer, social graph building with communities detection etc) and reporting.
- CD/DVD Inspector by InfinaDyne
- http://www.infinadyne.com/cddvd_inspector.html
- This is the only forensic-qualified tool for examinination of optical media. It has been around since 1999 and is in use by law enforcement, government and data recovery companies worldwide.
- EMail Detective - Forensic Software Tool by Hot Pepper Technology, Inc
- http://www.hotpepperinc.com/emd
- Elcomsoft Desktop Forensic Bundle by Elcomsoft
- https://www.elcomsoft.com/edfb.html
- All password recovery tools for unlocking documents, decrypting archives and crypto containers.
- Elcomsoft Premium Forensic Bundle by Elcomsoft
- https://www.elcomsoft.com/epfb.html
- A pack of every forensic tool of Elcomsoft for data extraction from mobile devices, unlocking documents, decrypting archives, breaking into encrypted containers, viewing and analyzing evidence.
- Facebook Forensic Toolkit (FFT) by Afentis_forensics
- http://www.facebookforensics.com
- eDiscovery toolkit to identify and clone full profiles; including wall posts, private messages, uploaded photos/tags, group details, graphically illustrate friend links, and generate expert reports.
- HBGary Responder Professional - Windows Physical Memory Forensic Platform
- http://www.hbgary.com
- ILook Investigator by Elliot Spencer and U.S. Dept of Treasury, Internal Revenue Service - Criminal Investigation (IRS)
- http://www.ilook-forensics.org/
- P2 Power Pack by Paraben
- https://www.paraben-forensics.com/catalog/product_info.php?cPath=25&products_id=187
- DateDecoder by Live-Forensics
- http://www.live-forensics.com/dl/DateDecoder.zip
- A command line tool that decodes most encoded time/date stamps found on a windows system, and outputs the time/date in a human readable format.
- RecycleReader by Live-Forensics
- http://www.live-forensics.com/dl/RecycleReader.zip
- A command line tool that outputs the contents of the recycle bin on XP, Vista and 7.
- Dstrings by Live-Forensics
- http://www.live-forensics.com/dl/Dstrings.zip
- A command line tool that searches for strings in a given file. It has the ability to compare the output of those strings against a dictionary to either exclude the dictionary terms in the output or only output files that match the dictionary. It also has the ability to search for IP Addresses and URLs/Email Addresses.
- Unique by Live-Forensics
- http://www.live-forensics.com/dl/Unique.zip
- A command line tool similar to the Unix uniq. Allows for unique string counts, as well as various sorting options.
- HashUtil by Live-Forensics
- http://www.live-forensics.com/dl/HashUtil.zip
- HashUtil.exe will calculate MD5, SHA1, SHA256 and SHA512 hashes. It has an option that will attempt to match the hash against the NIST/ISC MD5 hash databases.
- WindowsSCOPE Pro, Ultimate, Live
- Comprehensive Windows Memory Forensics and Cyber Analysis, Incident Response, and Education support.
- Software and hardware based acquisition with CaptureGUARD PCIe and ExpressCard
- Hardware based acquisition of memory on a locked computer via CaptureGUARD Gateway
- WindowsSCOPE Live provides memory analysis of Windows computers on a network from Android phones and tablets.
- MailXaminer by SysTools
- http://www.mailxaminer.com/
- Forensic & eDiscovery Tool to find digital email evidences from multiple email platform through its powerful Search mechanism.
- Twitter Forensic Toolkit (TFT) by Afentis_forensics
- http://www.twitterforensics.com
- eDiscovery toolkit to identify relevant Tweets, clone full profiles, download all tweets/media, data mine across comments, and generate expert reports.
- YouTube Forensic Toolkit (YFT) by Afentis_forensics
- http://www.youtubeforensics.com
- eDiscovery toolkit to identify relevant online media, download/convert videos, data mine across comments, and generate expert reports.
Open Source Tools
- AFFLIB
- A library for working with disk images. Currently AFFLIB supports raw, AFF, AFD, and EnCase file formats. Work to support segmented raw, iLook, and other formats is ongoing.
- Bulk Extractor
- https://github.com/simsong/bulk_extractor/wiki
- Bulk Extractor provides digital media triage by extracting Features from digital media.
- Bulk Extractor Viewer
- https://github.com/simsong/bulk_extractor/wiki/BEViewer
- Bulk Extractor Viewer is a browser UI for viewing Feature data extracted using Bulk Extractor.
- Digital Forensics Framework (DFF)
- DFF is cross-platform and open-source, user and developers oriented. It provide many features and is very modular. Our goal is to provide a powerful framework to the forensic community, so people can use only one tool during the analysis. http://www.digital-forensic.org
- foremost
- http://foremost.sf.net/
- Linux based file carving program
- FTimes
- http://ftimes.sourceforge.net/FTimes/index.shtml
- FTimes is a system baselining and evidence collection tool.
- gpart
- http://www.stud.uni-hannover.de/user/76201/gpart/
- Tries to guess the primary partition table of a PC-type hard disk in case the primary partition table in sector 0 is damaged, incorrect or deleted.
- Hachoir
- A generic framework for binary file manipulation, it supports FAT12, FAT16, FAT32, ext2/ext3, Linux swap, MSDOS partition header, etc. Recognize file type. Able to find subfiles (hachoir-subfile).
- hashdb
- http://github.com/simsong/hashdb/wiki
- A tool for finding previously identified blocks of data in media such as disk images.
- IPED
- https://github.com/lfcnassif/IPED
- An open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
- pyflag
- http://code.google.com/p/pyflag/
- Web-based, database-backed forensic and log analysis GUI written in Python.
- Scalpel
- http://www.digitalforensicssolutions.com/Scalpel/
- Linux and Windows file carving program originally based on foremost.
NDA and scoped distribution tools
Enterprise Tools (Proactive Forensics)
Forensics Live CDs
- Paladin Forensic Suite - Live Boot Ubuntu (Sumuri, LLC)
- https://www.sumuri.com/products/paladin/
- Simplifies various forensics tasks in a forensically sound manner via the PALADIN Toolbox.
See: Forensics Live CDs
Personal Digital Device Tools
GPS Forensics
PDA Forensics
Cell Phone Forensics
- Belkasoft Evidence Center
- BitPIM
- Cellebrite UFED
- DataPilot Secure View
- Elcomsoft Mobile Forensic Bundle
- .XRY
- http://www.msab.com/index
- Fernico ZRT
- ForensicMobile
- LogiCube CellDEK
- MOBILedit!
- Oxygen Forensic Suite 2010
- http://www.oxygen-forensic.com
- Paraben's Device Seizure and Paraben's Device Seizure Toolbox
- http://www.paraben-forensics.com/handheld_forensics.html
- Serial Port Monitoring
- TULP2G
SIM Card Forensics
- Cellebrite UFED
- .XRY
- ForensicSIM
- Paraben's SIM Card Seizure
- http://www.paraben-forensics.com/handheld_forensics.html
- SIMCon
Preservation Tools
Other Tools
- Chat Sniper
- http://www.alexbarnett.com/chatsniper.htm
- A forensic software tool designed to simplify the process of on-scene evidence acquisition and analysis of logs and data left by the use of AOL, MSN (Live), or Yahoo instant messenger.
- Serial Port Analyzer
- http://www.eltima.com/how-to-analyze-serial-port-activity/
- The tool to analyze serial port and device activity.
- Computer Forensics Toolkit
- http://computer-forensics.privacyresources.org
- This is a collection of resources, most of which are informational, designed specifically to guide the beginner, often in a procedural sense.
- Live View
- http://liveview.sourceforge.net/
- Live View is a graphical forensics tool that creates a VMware virtual machine out of a dd disk image or physical disk.
- Serial and USB ports sharing
- http://www.flexihub.com/serial-over-ethernet.html
- Share and access serial and USB ports over Ethernet
- Microsoft Virtual PC
- http://www.microsoft.com/windows/products/winfamily/virtualpc/default.mspx
- http://en.wikipedia.org/wiki/Virtual_PC
- VMware Player
- http://www.vmware.com/products/player/
- http://en.wikipedia.org/wiki/VMware#VMware_Workstation
- A free player for VMware virtual machines that will allow them to "play" on either Windows or Linux-based systems.
- VMware Server
- http://www.vmware.com/products/server/
- The free server product, for setting up/configuring/running VMware virtual machine.Important difference being that it can run 'headless', i.e. everything in background.
- Webtracer
- http://www.forensictracer.com
- Software for forensic analysis of internet resources (IP address, e-mail address, domain name, URL, e-mail headers, log files...)
- Recon for MAC OS X
- https://www.sumuri.com/products/recon/
- RECON for Mac OS X is simply the fastest way to conduct Mac Forensics, automates what an experienced examiner would need weeks to accomplish in minutes, now includes PALADIN 6 which comes with a full featured Forensic Suite, bootable forensic imager, a software write-blocker and so much more.
Hex Editors
- Okteta
- KDE's new cross-platform hex editor with features such as signature-matching
- http://utils.kde.org/projects/okteta/
- hexdump
- ...
- HexFiend
- A hex editor for Apple OS X
- http://ridiculousfish.com/hexfiend/
- Hex Workshop
- A hex editor from BreakPoint Software, Inc.
- http://www.bpsoft.com
- ReclaiMe Pro
- The built-in disk editor visualizes most known partition and filesystem objects: boot sectors, superblocks, partition headers in structured view. Low-level data editing for extra leverage.
- http://www.ReclaiMe-Pro.com
- WinHex
- Computer forensics software, data recovery software, hex editor, and disk editor from X-Ways.
- http://www.x-ways.net/winhex
- wxHexEditor
- A Multi-OS supported, open sourced, hex and disk editor.
- http://www.wxhexeditor.org
- xxd
- ...
- HexReader
- Live-Forensics software that reads windows files at specified offset and length and outputs results to the console.
- http://www.live-forensics.com/dl/HexReader.zip
Telephone Scanners/War Dialers
- PhoneSweep
- http://www.sandstorm.net/products/phonesweep/
- PhoneSweep is a commercial grade multi-line wardialer used by many security auditors to run telephone line scans in their organizations. PhoneSweep Gold is the distributed-access add-on for PhoneSweep, for organizations that need to run scans remotely.
- TeleSweep
- http://www.securelogix.com/modemscanner/
- SecureLogix is currently offering no-cost downloads of our award-winning TeleSweep Secure® modem-vulnerability scanner. This free modem scanning software can be used to dial a batch of corporate phone numbers and report on the number of modems connected to these corporate lines. *** Registration is required for obtaining a license key *** Still free however.
- WarVox
- https://github.com/rapid7/warvox
- WarVOX is a free, open-source VOIP-based war dialing tool for exploring, classifying, and auditing phone systems.
- Additional Software Names and Links (Jackpot!)
- http://www.wyae.de/software/paw/