P2Explorer - from Paraben free, requires registration IMDisk - great free tool for mounting Windows images on Windows systems, in read-only mode Raptor - bootable Linux CD that can be used for imaging (this will likely open up a whole flurry of similar emails, so let's just use this one as a placeholder for all bootable Linux CDs.) Also great for selected file extraction from the image, when you don't need everythingĭcfldd - another CLI imaging tool, available for the Windows platform vmdk files, etc - even allows you to 'acquire' other formats to raw/dd. Perl - 'nuff said mostly for creating my own toolsįTK Imager - great for opening raw (ie, dd) images. I'll start by providing tools that I use, as well as links to other tools, and from there, I will expand the list as I receive information (ie, comments, emails, etc.) Regardless, I thought that this would be a good way to start and even maintain a list of free tools (or at least some that have trials/demos available) that can/have been used during computer forensic examinations on Windows systems. In my mind, that kind of defeats the purpose of the listserv.why not just close it down and move everyone to Craigslist? I've seen requests in several listservs for listings of free tools that people use during examinations, and most often, the response is something akin to 'contact me off list'.
