Digital Forensics Tools
Practical forensics references for incident responders. Find artefacts fast, build timelines, preserve evidence correctly, and document chain of custody — all without leaving your browser.
Artefact Reference
Windows Forensics Artefact Finder
Select your investigation goal — lateral movement, persistence, credential theft, data exfil — and get exact file paths, registry keys, and extraction commands. No more Googling during an incident.
Find artefacts →Linux Forensics Artefact Guide
Every forensically relevant location on Linux — auth.log, bash history, cron, systemd journal, /proc, SSH artefacts, and application logs. Organised by investigation goal with exact extraction commands.
View Linux artefacts →Browser Forensics Reference
Forensic evidence in Chrome, Firefox, Edge, and Safari. Exact file paths, SQLite queries, and what each artefact proves. Covers history, downloads, credentials, cache, extensions, and sync data.
Browse artefacts →Windows Registry Forensics Map
Every forensically relevant registry key — ShimCache, AmCache, UserAssist, RecentDocs, MuiCache, Run keys, mounted devices. Exact paths, extraction commands, and what each key proves.
Explore registry →Forensic Tool Reference
Every essential free forensics tool — what it does, when to use it, key commands, and output format. Covers acquisition, analysis, timeline, network, and memory tools. Filterable by task.
Browse tools →Memory Acquisition Guide
Step-by-step volatile memory acquisition for Windows and Linux. Which tools to use, how to verify integrity, chain of custody for memory dumps, and VM vs physical acquisition differences.
View guide →Investigation Support
Forensic Timeline Builder
Paste mixed log entries — Windows events, Sysmon, firewall, proxy. The tool sorts chronologically, maps events to MITRE techniques, labels attack phases, and generates a structured IR timeline.
Build timeline →Chain of Custody Generator
Generate a legally formatted chain of custody document for digital evidence. Enter incident details, evidence items with hash values, and personnel. Output is formatted for Indian legal proceedings.
Generate document →Evidence & Memory Analysis
Forensic Timestamp Converter
Convert between 10 timestamp formats: Unix epoch, Windows FILETIME, LDAP, HFS+, Chrome WebKit, .NET OLE, FAT, ISO 8601. IST support. Copy buttons on every result.
Open tool →Evidence Hash Calculator
Calculate MD5, SHA1, SHA256, and SHA512 hashes for chain of custody. Files never leave your browser — all processing is local. Generates printable chain of custody report.
Open tool →Volatility Command Reference
Searchable reference for all Volatility 2 and Volatility 3 plugins. Switchable by version. Every plugin has exact syntax, key output fields, and analyst tips.
Open tool →DFIR in Indian organisations — what the regulatory environment requires.
Digital forensics and incident response (DFIR) is the discipline of investigating security incidents — collecting and preserving evidence, reconstructing what happened, identifying the scope of a compromise, removing the attacker, and recovering operations. In India, DFIR has a specific legal and regulatory dimension that affects how evidence must be handled. The Indian Evidence Act and its amendments govern how digital evidence is admissible in court proceedings. Section 65B certificates are required for electronic evidence to be admitted. CERT-In Directions 2022 impose a six-hour reporting window that begins from when an organisation first becomes aware of an incident — which means forensic investigation and regulatory notification run in parallel, not sequentially.
The most critical DFIR principle is the order of operations: evidence is collected before containment where possible, volatile evidence (RAM, running processes, network connections) is collected before non-volatile evidence (disk images), and no action is taken on a compromised system before its state is preserved. Many Indian incident responses are compromised because the first instinct is to run antivirus or reboot the affected system — both of which destroy the volatile evidence that would have answered how the attacker got in and what they did.
The tools on this page cover the full DFIR process: memory forensics commands, Windows artefact reference, log analysis, malware triage, and the evidence collection workflow. They are designed for DFIR practitioners and security analysts handling incidents in real environments, not for academic study.
Frequently asked questions — DFIR
What is the order of volatility in digital forensics?
The order of volatility refers to how quickly different types of evidence are lost if a system is powered off or rebooted. From most to least volatile: CPU registers and cache (lost immediately), RAM contents (lost on reboot), network connections and running processes (lost on reboot), temporary files (may survive reboot), disk data (survives power off), and backup media. The practical implication: always acquire memory (RAM) before rebooting any potentially compromised system. A reboot before memory acquisition permanently destroys evidence of what was running in memory — which is the only evidence available for fileless malware attacks.
What is a Section 65B certificate and when is it required?
Section 65B of the Indian Evidence Act (amended) governs the admissibility of electronic records in court proceedings. A Section 65B certificate is a formal statement from a responsible official certifying that the electronic record was produced by a computer system, that the system was operating properly, that the information was regularly fed into the system, and that the record is a true copy. Without this certificate, electronic evidence — including SIEM logs, email records, or forensic images — may not be admissible. Any incident response that may lead to legal proceedings requires proper evidence handling from the start, including Section 65B documentation.
What is Volatility and what can it find in a memory dump?
Volatility is the leading open-source memory forensics framework. Given a raw memory dump from a Windows or Linux system, it can list all running processes (including hidden ones), show the full command line of each process, list all network connections, extract password hashes from LSASS, identify injected code in legitimate processes, and find encryption keys for encrypted files. Memory forensics is the primary technique for investigating fileless malware attacks, which leave no executable files on disk — the only evidence exists in RAM.
What Windows artefacts are most valuable in an incident investigation?
The most forensically valuable Windows artefacts are: Windows Event Logs (Security, System, Sysmon) — record authentication, process creation, and service installation; Prefetch files — prove an executable ran even if it was subsequently deleted; the Master File Table (MFT) — records every file's creation and modification timestamps; ShimCache and AmCache — execution history including deleted files; and Windows Registry hives — record persistence mechanisms, USB device history, and recently accessed files. The Memory Forensics and Windows artefact reference tools on this page provide command references for collecting and interpreting each of these.