17.3
Arkime is an open-source network analysis and session search tool that passively observes traffic and creates searchable session records.
Free planOpen sourceWebAPILinux
Alternatives to Hayabusa
Hayabusa turns Windows EVTX logs into timelines for threat hunting, with Sigma support that includes v2 correlation rules. It consolidates events from a single host or thousands into CSV, JSON, or JSONL, and adds summaries, keyword pivoting, HTML reports, and MITRE ATT&CK mapping. It can run live, analyze collected logs offline, or hunt across endpoints through the Velociraptor Hayabusa artifact. Its multi-threaded Rust implementation is described as capable of up to a 5x…
27.3
Plaso is a Python-based engine for building timelines used in digital forensic analysis.
Free planOpen sourceAPILinuxmacOS
37.1
CAINE is a free Italian GNU/Linux live distribution for digital forensics.
Free planOpen sourceLinuxSelf-hostedWindows
- 4
Paraben E3 Forensic Platform
Paraben E3 Forensic Platform is a digital investigation suite for professionals in forensics, incident response, OSINT, cyber, and eDiscovery.
AndroidiOSLinuxmacOS7.1From $699 a year - 5
OSForensics
OSForensics is digital investigation software for extracting and examining forensic data from computers.
Free planAndroidSelf-hostedWindows7.0From $945 a year - 6
NetworkMiner
NetworkMiner analyzes captured network traffic and can sniff live traffic, extracting artifacts such as files, images, emails and passwords from PCAP files.
Free planLinuxmacOSWindows6.9$1,300 one-time - 7
ADF Triage-G2
ADF Triage-G2 is digital forensic triage software for computer and media exploitation during sensitive site work.
AndroidiOSLinuxmacOS6.8 - 8
Exterro FTK Imager
Exterro FTK Imager is a forensic imaging and preview tool for collecting and preserving digital evidence.
Free planWebWindows6.7From $499 a year - 9
Belkasoft X Forensic
Belkasoft X Forensic acquires, analyzes, and reports digital evidence from computers, mobile devices, RAM, cars, drones, and cloud sources.
AndroidiOSLinuxmacOS6.5 - 10
MOBILedit Forensic
MOBILedit Forensic is paid Windows software for extracting and analyzing evidence from phones, smartwatches, applications, backups, filesystems, and cloud services.
Windows6.4€99 one-time - 11
SUMURI PALADIN
SUMURI PALADIN is a Linux live environment for forensic imaging, triage, and recovery, supported by donations.
Free planLinux6.4$99 one-time - 12
Cellebrite Inseyets
Cellebrite Inseyets is a digital forensics suite for accessing, extracting, and analyzing digital evidence.
WebWindows6.2 - 13
SIFT Workstation
SIFT Workstation is a free, open-source collection of tools for incident response and digital forensic examination.
Free planLinuxSelf-hostedWindows6.2Free plan - 14
The Sleuth Kit
The Sleuth Kit is an open-source C library and collection of command-line tools for examining disk images, volumes, and file-system data.
Free planAPILinuxmacOSSelf-hosted6.2Free plan - 15
Passware Kit Mobile
Passware Kit Mobile is forensic software for extracting and decrypting information from locked or encrypted mobile devices.
LinuxmacOSWindows6.1From €2,795 a year - 16
Timesketch
Timesketch is a free, open-source tool for collaborative forensic timeline analysis.
Free planWebAPILinuxSelf-hosted6.1Free plan - 17
Volatility 3
Volatility 3 is a free, open-source framework for extracting digital artifacts from volatile memory (RAM) samples.
Free planLinuxmacOSSelf-hostedWindows6.1Free plan - 18
Elcomsoft Mobile Forensic Bundle
Elcomsoft Mobile Forensic Bundle brings together tools for acquiring and analyzing evidence from phones, tablets, accounts, and file-system images.
LinuxmacOSWindows6.0$3,999 one-time - 19
MSAB XRY
MSAB XRY is Windows-based software for extracting mobile-device data during digital investigations.
AndroidiOSWindows5.9 - 20
SUMURI RECON LAB
SUMURI RECON LAB is a forensic analysis suite that runs natively on macOS and examines evidence from macOS, Windows, Linux, iOS, Android, Google…
macOSWindows5.9$2,499 one-time - 21
X-Ways Forensics
X-Ways Forensics is a Windows work environment for computer forensic examiners, with tools for imaging, evidence analysis, and case management.
APISelf-hostedWindows5.9$1,550 one-time - 22
Magnet AXIOM Cyber
Magnet AXIOM Cyber analyzes digital evidence across remote endpoints, cloud environments, and mobile devices for corporate investigations.
LinuxmacOSSelf-hostedWindows5.8 - 23
Tsurugi Linux
Tsurugi Linux is a free Linux distribution for digital forensics, incident response, malware analysis, and OSINT.
Free planLinux5.8Free plan - 24
X-Ways Imager
Windows5.8From 74 CHF a year - 25
Guymager
Guymager is a free Linux forensic imager for acquiring storage devices and removable media.
Free planLinux5.7Free plan - 26
Oxygen Forensic Detective
Windows5.6 - 27
Autopsy
LinuxmacOSWindows4.9 - 28
Exterro FTK Central
WebWindows4.8 - 29
OpenText Forensic
LinuxmacOSWindows4.8