17.3
Arkime is an open-source network analysis and session search tool that passively observes traffic and creates searchable session records.
Free planOpen sourceWebAPILinux
Best Digital Forensics Software in 2026
Investigations involving digital evidence can call for different tools and workflows. Compare evidence sources and supported platforms with disk imaging, memory forensics, and mobile forensics; export formats and case collaboration can also shape how findings are handled and shared. Free-plan availability and paid-from pricing provide additional points of comparison. Paraben E3 Forensic Platform, CAINE, and Oxygen…
27.3
Plaso is a Python-based engine for building timelines used in digital forensic analysis.
Free planOpen sourceAPILinuxmacOS
37.1
CAINE is a free Italian GNU/Linux live distribution for digital forensics.
Free planOpen sourceLinuxSelf-hostedWindows
- 4
Paraben E3 Forensic Platform
Paraben E3 Forensic Platform is a digital investigation suite for professionals in forensics, incident response, OSINT, cyber, and eDiscovery.
AndroidiOSLinuxmacOS7.1From $699 a year - 5
OSForensics
OSForensics is digital investigation software for extracting and examining forensic data from computers.
Free planAndroidSelf-hostedWindows7.0From $945 a year - 6
NetworkMiner
NetworkMiner analyzes captured network traffic and can sniff live traffic, extracting artifacts such as files, images, emails and passwords from PCAP files.
Free planLinuxmacOSWindows6.9$1,300 one-time - 7
ADF Triage-G2
ADF Triage-G2 is digital forensic triage software for computer and media exploitation during sensitive site work.
AndroidiOSLinuxmacOS6.8 - 8
Exterro FTK Imager
Exterro FTK Imager is a forensic imaging and preview tool for collecting and preserving digital evidence.
Free planWebWindows6.7From $499 a year - 9
Belkasoft X Forensic
Belkasoft X Forensic acquires, analyzes, and reports digital evidence from computers, mobile devices, RAM, cars, drones, and cloud sources.
AndroidiOSLinuxmacOS6.5 - 10
MOBILedit Forensic
MOBILedit Forensic is paid Windows software for extracting and analyzing evidence from phones, smartwatches, applications, backups, filesystems, and cloud services.
Windows6.4€99 one-time - 11
SUMURI PALADIN
SUMURI PALADIN is a Linux live environment for forensic imaging, triage, and recovery, supported by donations.
Free planLinux6.4$99 one-time - 12
Cellebrite Inseyets
Cellebrite Inseyets is a digital forensics suite for accessing, extracting, and analyzing digital evidence.
WebWindows6.2 - 13
SIFT Workstation
SIFT Workstation is a free, open-source collection of tools for incident response and digital forensic examination.
Free planLinuxSelf-hostedWindows6.2Free plan - 14
The Sleuth Kit
The Sleuth Kit is an open-source C library and collection of command-line tools for examining disk images, volumes, and file-system data.
Free planAPILinuxmacOSSelf-hosted6.2Free plan - 15
Hayabusa
Hayabusa is a free, open-source tool for Windows event log forensics and threat hunting.
Free planLinuxmacOSWindows6.1Free plan - 16
Passware Kit Mobile
Passware Kit Mobile is forensic software for extracting and decrypting information from locked or encrypted mobile devices.
LinuxmacOSWindows6.1From €2,795 a year - 17
Timesketch
Timesketch is a free, open-source tool for collaborative forensic timeline analysis.
Free planWebAPILinuxSelf-hosted6.1Free plan - 18
Volatility 3
Volatility 3 is a free, open-source framework for extracting digital artifacts from volatile memory (RAM) samples.
Free planLinuxmacOSSelf-hostedWindows6.1Free plan - 19
Elcomsoft Mobile Forensic Bundle
Elcomsoft Mobile Forensic Bundle brings together tools for acquiring and analyzing evidence from phones, tablets, accounts, and file-system images.
LinuxmacOSWindows6.0$3,999 one-time - 20
MSAB XRY
MSAB XRY is Windows-based software for extracting mobile-device data during digital investigations.
AndroidiOSWindows5.9 - 21
SUMURI RECON LAB
SUMURI RECON LAB is a forensic analysis suite that runs natively on macOS and examines evidence from macOS, Windows, Linux, iOS, Android, Google…
macOSWindows5.9$2,499 one-time - 22
X-Ways Forensics
X-Ways Forensics is a Windows work environment for computer forensic examiners, with tools for imaging, evidence analysis, and case management.
APISelf-hostedWindows5.9$1,550 one-time - 23
Magnet AXIOM Cyber
Magnet AXIOM Cyber analyzes digital evidence across remote endpoints, cloud environments, and mobile devices for corporate investigations.
LinuxmacOSSelf-hostedWindows5.8 - 24
Tsurugi Linux
Tsurugi Linux is a free Linux distribution for digital forensics, incident response, malware analysis, and OSINT.
Free planLinux5.8Free plan - 25
X-Ways Imager
Windows5.8From 74 CHF a year