I generally categorize software that I load onto my forensic workstation(s) into three classifications or tiers:
Tier 1 - Primary Forensic Analysis Software
- EnCase, X-Ways, FTK, Forensic Explorer, iLook, etc.
- Internet Evidence Finder, RegRipper, Hex editor, etc.
- Office Products (Word), Packet capture/analysis tools, screen capturing software, etc.
There is no shortage of opinion and assertions of which primary forensic analysis tool (tier 1) might be the best for the job, just check out any forensic listserv or message forum. But this post isn't about those tools.
This post is really about the often unmentioned supporting tools that make my life easier as an examiner. They are the tools that I rely upon during almost every examination to help process or view the data from whatever primary analysis tool (FTK, EnCase X-Ways, etc) that I may be using.
There are literally hundreds of tier 2 & 3 tools out there, but my intent was to list those that are relied upon in almost every case. Please feel free to comment or add your own in the comment section, I am sure everyone reading will benefit by hearing about a tool that you may use and why. Here are some of mine, in no particular order.
- Internet Evidence Finder (IEF) - Deep Internet artifact searching/reporting
- 010 Hex Editor - Great hex editor with structure templates and scripting language
- SIFT Workstation - SANS virtual machine with lots of tools
- FTK Imager - General purpose imaging and viewing utility
- Event Log Explorer - Windows event log viewer
- RegViewer - Windows registry viewer
- Liveview - Forensic virtualization
- Hypersnap - Great screen capture software
- Microsoft Office - Report writing
- Notepad++ - Great simple text editor with source code highlighting and other powerful features
- VMware - Virtualization Software
- Wireshark - Packet analysis software
- ActiveState Perl - I tend to write lots of little utilities for specific processing/analysis purposes
- Cygwin - *nix environment on Windows and lots of useful parsing tools
- Splunk - Log aggregation, searching and reporting tool
- WinRar - Archive utility that handles ZIP, RAR, 7z, TAR & GZ
- Irfanview - Image viewer
- VLC - Video player
- FFplay - Video player
- Plist Editor - Plist viewer
- Hashcalc - Hash calculator that supports several different algorithms
- LogParser - Log parsing utility
- SQLite Expert - SQLite DB viewer
I will mention two additional pieces of software that are not necessarily used during the forensic examination process, but that I reply upon heavily:
Both of these are information managers or journals (one is cloud based, the other is not). I use them to record information about a process, file structures or take screenshots once I learn a specific procedure or I want to record something so I can understand it a year from now after I may have forgotten all the offsets or structure I may have just learned.