If you are using Splunk then Forensic Investigator will be a very handy tool. Memory dumps may contain encrypted volume’s password and login credentials for webmails and social network services. RAM Capturer by Belkasoft is a free tool to dump the data from computer’s volatile memory. NMAP is supported on most of the operating systems including Windows, Linux, Solaris, MAC OS, HP-UX etc. NMAP (Network Mapper) is one of the most popular networks and security auditing tools.

Network Miner provide extracted artifacts in an intuitive user interface. You can use Magnet RAM capture to capture the physical memory of a computer and analyze artifacts in memory.Īn interesting network forensic analyzer for Windows, Linux & MAC OS X to detect OS, hostname, sessions and open ports through packet sniffing or by PCAP file. Wireshark will be handy to investigate network related incident. Wireshark is a network capture and analyzer tool to see what’s happening in your network. It supports TrueCrypt, PGP, Bitlocker, Safeboot encrypted volumes. Autospy is used by thousands of users worldwide to investigate what actually happened in the computer.Įncrypted Disk Detector can be helpful to check encrypted physical drives.

AutopsyĪutopsy is a GUI-based open source digital forensic program to analyze hard drives and smart phones effectively.

As such, they all provide the ability to bring back in-depth information about what’s “under the hood” of a system. Whether it’s for an internal human resources case, an investigation into unauthorized access to a server, or if you just want to learn a new skill, these suites and utilities will help you conduct memory forensic analysis, hard drive forensic analysis, forensic image exploration, forensic imaging and mobile forensics. Here are some of the computer forensic investigator tools you would need. Forensic investigations are always challenging as you may gather all the information you could for the evidence and mitigation plan.

Encase free file viewer