DFIR — Velociraptor, Autopsy, KAPE

Digital forensics & incident response toolkits collect evidence, build timelines, and answer "what did the attacker actually do." 2024–26 is the era of Velociraptor + Eric Zimmerman tools + CyberChef. For memory specifically see Memory Forensics. For malware reverse-engineering see Malware Analysis (Sandbox). For SIEM-side correlation see SIEM (Wazuh / Graylog). For incident-management workflow see Incident Response (TheHive).

Endpoint collection at scale

• ★ ★ Velociraptor (Rapid7-sponsored OSS) — endpoint visibility / hunting / forensic collection; VQL query language; deploys cross-platform agents; the modern default for IR fleets. Free. The 2024–26 mainstream pick replacing GRR.
• GRR Rapid Response (Google, sunset for new use) — older fleet forensics; still in some shops.
• OSQuery (Meta) — live endpoint state as SQL; great for hunts but not for raw artifacts. See EDR / OSQuery.
• F-Response — paid; cross-platform remote evidence acquisition.
• EnCase Endpoint Investigator / FTK — paid heavyweight; older shops.

Single-system imaging / triage

• ★ KAPE (Kroll Artifact Parser and Extractor) — Eric Zimmerman; targeted artifact collection + parsing on Windows. Free for non-commercial.
• CyLR / CyLRr — fast Windows triage.
• DFIR ORC — French ANSSI's collector.
• UAC (Unix-like Artifacts Collector) — Linux / macOS / AIX triage.
• fls / icat / Sleuth Kit — disk image traversal.
• dd / dcfldd / FTK Imager — image acquisition.
• Magnet Response / Magnet ACQUIRE — free imaging utilities from Magnet Forensics.

Disk / file analysis

• ★ Autopsy + The Sleuth Kit — open-source forensic GUI; case management, file system traversal, timeline, keyword. Free.
• X-Ways Forensics — paid; tiny + brilliant; classic hex/disk reviewer.
• EnCase / FTK / Magnet AXIOM — paid heavyweights.
• mac_apt — macOS artifact parser.
• APFSDump / fsleuth — APFS support.

Eric Zimmerman tools (essential Windows artifacts)

• ★ MFTECmd — $MFT parser; "what files existed when."
• ★ EvtxECmd — Windows event-log parser.
• ★ RECmd — registry hive parser; with built-in batch files.
• ★ RegRipper (Harlan Carvey) — older registry parser; extensive plugin set.
• JLECmd / LECmd / PECmd — Jump Lists / LNK / Prefetch.
• Timeline Explorer — sortable CSV review GUI.
• EZTools full suite — ericzimmerman.github.io — free.

Timelining

• ★ Plaso / log2timeline — super-timelining from any artifact source. Free.
• Timesketch (Google) — collaborative timeline review web UI.
• Aurora IR / Hayabusa — Sigma-rules over Windows event logs (timeline + detection).
• Chainsaw (F-Secure / WithSecure) — fast Sigma + custom-rule hunting on event logs.
• Zircolite — event log + Sigma at speed.

Browser / application artifacts

• Hindsight (Obsidian Forensics) — Chromium history.
• MZHistoryView / NirSoft tools — quick-and-dirty browser artifact viewers.
• dbeaver / SQLite Browser — open the underlying SQLite DBs directly.
• SegInsight (LiveResponseCollection) — comprehensive triage scripts.

Universal swiss-army

• ★ ★ CyberChef (GCHQ) — "the cyber swiss-army knife"; recipes for decoding, decrypting, extracting; runs in a browser. Free. Indispensable.
• YARA — see Detection (Sigma / YARA / ATT&CK).
• strings / xxd / hexdump — never not useful.

DFIR distros (linking out)

• See Pentest Linux Distros: SIFT Workstation, CAINE, REMnux, Tsurugi.

Cloud / SaaS forensics

• CloudTrail / Azure ActivityLog / GCP Audit Logs — primary evidence.
• MTH (Microsoft Threat Hunting) — KQL hunting libraries.
• 365 Investigator / Hawk — M365 IR helpers.
• CloudHunter — multi-cloud IR support.

IR runbook tooling (link)

• See Incident Response (TheHive) — TheHive, Cortex, DFIR-IRIS, MISP integration.

Pick this if…

• Default fleet forensic collection: Velociraptor.
• Single-host Windows triage: KAPE.
• Disk-image GUI review: Autopsy.
• Windows artifact parsing: Eric Zimmerman tools (MFTECmd, EvtxECmd, RECmd).
• Timelining: Plaso → Timesketch.
• Sigma over event logs: Hayabusa or Chainsaw.
• Decoding / extracting blobs: CyberChef.