Arkime is an open-source network analysis and session search tool that passively observes traffic and creates searchable session records.
Alternatives to OpenText Forensic
Plaso is a Python-based engine for building timelines used in digital forensic analysis.
CAINE is a free Italian GNU/Linux live distribution for digital forensics.
- 4

Paraben E3 Forensic Platform
Paraben E3 Forensic Platform is a digital investigation suite for professionals in forensics, incident response, OSINT, cyber, and eDiscovery.
AndroidiOSLinuxmacOS7.1From $699 a year - 5

OSForensics
OSForensics is digital investigation software for extracting and examining forensic data from computers.
Free planAndroidSelf-hostedWindows7.0From $945 a year - 6

NetworkMiner
NetworkMiner analyzes captured network traffic and can sniff live traffic, extracting artifacts such as files, images, emails and passwords from PCAP files.
Free planLinuxmacOSWindows6.9$1,300 one-time - 7

ADF Triage-G2
ADF Triage-G2 is digital forensic triage software for computer and media exploitation during sensitive site work.
AndroidiOSLinuxmacOS6.8 - 8

Exterro FTK Imager
Exterro FTK Imager is a forensic imaging and preview tool for collecting and preserving digital evidence.
Free planWebWindows6.7From $499 a year - 9
Belkasoft X Forensic
Belkasoft X Forensic acquires, analyzes, and reports digital evidence from computers, mobile devices, RAM, cars, drones, and cloud sources.
AndroidiOSLinuxmacOS6.5 - 10
MOBILedit Forensic
MOBILedit Forensic is paid Windows software for extracting and analyzing evidence from phones, smartwatches, applications, backups, filesystems, and cloud services.
Windows6.4€99 one-time - 11
SUMURI PALADIN
SUMURI PALADIN is a Linux live environment for forensic imaging, triage, and recovery, supported by donations.
Free planLinux6.4$99 one-time - 12
Cellebrite Inseyets
Cellebrite Inseyets is a digital forensics suite for accessing, extracting, and analyzing digital evidence.
WebWindows6.2 - 13
SIFT Workstation
SIFT Workstation is a free, open-source collection of tools for incident response and digital forensic examination.
Free planLinuxSelf-hostedWindows6.2Free plan - 14
The Sleuth Kit
The Sleuth Kit is an open-source C library and collection of command-line tools for examining disk images, volumes, and file-system data.
Free planAPILinuxmacOSSelf-hosted6.2Free plan - 15
Hayabusa
Hayabusa is a free, open-source tool for Windows event log forensics and threat hunting.
Free planLinuxmacOSWindows6.1Free plan - 16
Passware Kit Mobile
Passware Kit Mobile is forensic software for extracting and decrypting information from locked or encrypted mobile devices.
LinuxmacOSWindows6.1From €2,795 a year - 17
Timesketch
Timesketch is a free, open-source tool for collaborative forensic timeline analysis.
Free planWebAPILinuxSelf-hosted6.1Free plan - 18
Volatility 3
Volatility 3 is a free, open-source framework for extracting digital artifacts from volatile memory (RAM) samples.
Free planLinuxmacOSSelf-hostedWindows6.1Free plan - 19
Elcomsoft Mobile Forensic Bundle
Elcomsoft Mobile Forensic Bundle brings together tools for acquiring and analyzing evidence from phones, tablets, accounts, and file-system images.
LinuxmacOSWindows6.0$3,999 one-time - 20
MSAB XRY
MSAB XRY is Windows-based software for extracting mobile-device data during digital investigations.
AndroidiOSWindows5.9 - 21
SUMURI RECON LAB
SUMURI RECON LAB is a forensic analysis suite that runs natively on macOS and examines evidence from macOS, Windows, Linux, iOS, Android, Google…
macOSWindows5.9$2,499 one-time - 22
X-Ways Forensics
X-Ways Forensics is a Windows work environment for computer forensic examiners, with tools for imaging, evidence analysis, and case management.
APISelf-hostedWindows5.9$1,550 one-time - 23

Magnet AXIOM Cyber
Magnet AXIOM Cyber analyzes digital evidence across remote endpoints, cloud environments, and mobile devices for corporate investigations.
LinuxmacOSSelf-hostedWindows5.8 - 24
Tsurugi Linux
Tsurugi Linux is a free Linux distribution for digital forensics, incident response, malware analysis, and OSINT.
Free planLinux5.8Free plan - 25
X-Ways Imager
Windows5.8From 74 CHF a year - 26
Guymager
Guymager is a free Linux forensic imager for acquiring storage devices and removable media.
Free planLinux5.7Free plan - 27
Oxygen Forensic Detective
Windows5.6 - 28
Autopsy
LinuxmacOSWindows4.9 - 29
Exterro FTK Central
WebWindows4.8
