Open Source Tools · Category

Digital forensics and incident response

Disk, memory and timeline analysis tools used to investigate incidents and preserve evidence.

Alternatives toOpenText Forensic (EnCase)

SearchLicenceLanguageSort by

10 tools

radare2
UNIX-like reverse engineering framework
Command-line reverse engineering framework with a disassembler, debugger, hex editor and scripting for many architectures and file formats.
Stars
25k
Forks
3.4k
Last commit
today
LGPL-3.0-onlyOpen sourceReverse engineering and malware analysis
Alternative toIDA Pro
osquery
Query your endpoints with SQL
Exposes the operating system as a relational database so processes, users, packages and configuration can be queried with SQL on Linux, macOS and Windows.
Stars
24k
Forks
2.6k
Last commit
4 days ago
Apache-2.0 OR GPL-2.0-onlyOpen sourceEndpoint visibility and response
Alternative toCrowdStrike Falcon
Wireshark
Network protocol analyser
The widely used network protocol analyser: capture live traffic or open capture files and inspect thousands of protocols with display filters.
Stars
10k
Forks
2.2k
Last commit
today
GPL-2.0-onlyOpen sourceNetwork scanning and analysis
YARA
Pattern matching for malware research
Tool and rule language from VirusTotal to identify and classify malware samples using textual and binary patterns plus conditions.
Stars
10k
Forks
1.6k
Last commit
4 days ago
BSD-3-ClauseOpen sourceReverse engineering and malware analysis
Zeek
Network security monitoring and traffic analysis framework
Network analysis framework, formerly Bro, that turns traffic into rich, structured logs of connections and protocols, with its own scripting language.
Stars
8.1k
Forks
1.4k
Last commit
today
BSD-3-ClauseOpen sourceIDS, IPS and network monitoring
Alternative toDarktrace
Security Onion
Platform for threat hunting and security monitoring
Linux distribution and platform for network security monitoring, log management and threat hunting that bundles Suricata, Zeek and Elastic components.
Stars
4.9k
Forks
681
Last commit
1 month ago
Elastic-2.0Source-availableSIEM, XDR and log management
Alternative toSplunk Enterprise Security Microsoft Sentinel+1
Volatility 3
Memory forensics framework
Framework for extracting digital artefacts from memory images (RAM dumps) of Windows, Linux and macOS systems, rewritten in Python 3.
Stars
4.5k
Forks
726
Last commit
7 days ago
Volatility SL 1.0Source-availableDigital forensics and incident response
Alternative toOpenText Forensic (EnCase)
Velociraptor
Endpoint visibility and digital forensics at scale
DFIR tool that collects forensic artefacts and hunts across fleets of endpoints with its query language VQL, from a single server binary.
Stars
4.4k
Forks
672
Last commit
2 days ago
AGPL-3.0-onlyOpen sourceEndpoint visibility and response
Alternative toCrowdStrike Falcon OpenText Forensic (EnCase)
Autopsy
Digital forensics platform built on The Sleuth Kit
Graphical digital forensics platform that analyses disk images and devices with The Sleuth Kit, with modules for timelines, keyword search and artefacts.
Stars
3.4k
Forks
707
Last commit
5 months ago
Apache-2.0Open sourceDigital forensics and incident response
Alternative toOpenText Forensic (EnCase)
Plaso (log2timeline)
Super timeline creation for forensic analysis
Python engine that extracts timestamps from hundreds of file and log formats on a disk image and merges them into one forensic super timeline.
Stars
2.2k
Forks
431
Last commit
today
Apache-2.0Open sourceDigital forensics and incident response
Alternative toOpenText Forensic (EnCase)