Velociraptor
Endpoint visibility and digital forensics at scale
DFIR tool that collects forensic artefacts and hunts across fleets of endpoints with its query language VQL, from a single server binary.
- Stars
- 4.4k
- Forks
- 672
- Last commit
- 2 days ago
Open Source Tools · Alternatives
Open-source alternatives to OpenText Forensic (EnCase)
OpenText Forensic, formerly EnCase, is a commercial digital forensics suite. Autopsy (with The Sleuth Kit) and Plaso cover disk analysis and timelines in open source; Volatility covers memory analysis under a source-available licence.
OpenText Forensic (EnCase) is a commercial product by OpenText (official site). Category: Digital forensics and incident response.
Comparison
| Tool | Licence | Stars | Last commit | Best for |
|---|---|---|---|---|
| Velociraptor | AGPL-3.0-onlyOpen source | 4.4k | 2 days ago | Endpoint visibility and digital forensics at scale |
 Autopsy | Apache-2.0Open source | 3.4k | 5 months ago | Digital forensics platform built on The Sleuth Kit |
 Plaso (log2timeline) | Apache-2.0Open source | 2.2k | today | Super timeline creation for forensic analysis |
 Volatility 3 | Volatility SL 1.0Source-available | 4.5k | 7 days ago | Memory forensics framework |
Open-source options
Autopsy
Digital forensics platform built on The Sleuth Kit
Graphical digital forensics platform that analyses disk images and devices with The Sleuth Kit, with modules for timelines, keyword search and artefacts.
- Stars
- 3.4k
- Forks
- 707
- Last commit
- 5 months ago
Alternative toOpenText Forensic (EnCase)Plaso (log2timeline)
Super timeline creation for forensic analysis
Python engine that extracts timestamps from hundreds of file and log formats on a disk image and merges them into one forensic super timeline.
- Stars
- 2.2k
- Forks
- 431
- Last commit
- today
Alternative toOpenText Forensic (EnCase)
Source-available options
The code is public, but the licence is not approved by the Open Source Initiative. Read the licence before using these commercially.
Volatility 3
Memory forensics framework
Framework for extracting digital artefacts from memory images (RAM dumps) of Windows, Linux and macOS systems, rewritten in Python 3.
- Stars
- 4.5k
- Forks
- 726
- Last commit
- 7 days ago
Alternative toOpenText Forensic (EnCase)
Product names are trademarks of their owners. ThreatWire is not affiliated with OpenText. The comparison covers what each tool is designed to do, not a feature-by-feature equivalence.