Top list of computer forensics software

Chưa phân loại
The last article was an introduction to computer forensics explaining it’s most usual practices. This article is the continuation with an introduction to the most popular and powerful tools to carry out the common practices of computer forensics.


I consider Autopsy, which comes by default on CAINE and Kali Linux, the first tool to get introduced to forensics due it’s graphical and intuitive interface to manage computer forensic tools. Autopsy optimizes the process by using multiple processor cores while running in the background and can tell you in advance if the process will lead to a positive result. Autopsy can also be used as graphical interface for different command line tools, supports extensions for integration with third party tools such as PhotoRec already featured on LinuxHint to improve and add functions.

As said, it comes by default on Kali, Debian and Ubuntu users can get Autopsy by running:

apt install autopsy -y

Official website:

CAINE (Computer Aided Investigative Environment)

CAINE is an Ubuntu Linux based distribution specifically designed for computer forensics, it comes with Autopsy by default creating a very friendly environment for the user. CAINE is a great assistant, as an OS, since it applies by default common forensics practices like protecting the storage devices from getting corrupted or overwritten during the forensic process.

CAINE is an up to date Linux distribution highly recommended to get started with computer forensics.

Official website:


P0f is an analyzer for the interaction between different devices through networking. P0f is capable to identify the OS and software used by different devices connected in passive mode, rather than sending packets to analyze the reply P0f only captures packets for later analysis, that’s why it can lead to better results than Nmap when fingerprinting. Practical uses of P0f may include detecting an attacker during an ongoing pentesting session, network surveillance and additional information on connections to setup proper security measures. P0f wasn’t updated for a long time and has come back as P03 with support for modern OS and software. In a future article we’ll trace attackers using different tools including P0f.

Debian and Ubuntu users can install P0f by running:

apt install p0f -y

Official website:


During a criminal investigation analysis of browsing activity is among the first protocol steps. As said above, Autopsy allows us to enable extensions to research the browsing activity of the user. Dumpzilla is a tool focused specifically on recovering browsing data from Mozilla Firefox browsers or derivatives like Iceweasel or Seamonkey.  Dumpzilla can grant us a lot of valuable information like usernames, passwords, browsing history and any information stored in cookies or user preferences. Despite the fact that it is very specific running Dumpzilla against a target with Firefox is recommended, in spite of the fact that it wasn’t updated for the last two years.

Dumpzilla isn’t included in default repositories, you can get it from:

Official website:


Volatility allows us to investigate the live RAM of a device, which means information which wasn’t stored on the hard drive, but left artifacts or traces on the live RAM. This tool, which comes by default both on CAINE and Kali Linux, can lead us to useful information after an incident on a device, like what processes were running, or are running, during an event. To install volatility on Debian you can run

apt install volatility -y

Official website:


A RootKit is malicious software installed locally or remotely on a device to grant illegitimate access to an attacker, we can do a grotesque comparison between rootKits and trojan servers despite small differences (RootKIts include additional functions). RootKits can modify the system files and remove traces of illegitimate intrusions. Here is where ChkRooKit comes analyzing binaries for modifications, logs and other traces which could get removed by an intruder. On Debian you can get chkrootkit by running:

apt install chkrootkit -y

Official website:

I hope you found this article useful to realize computer forensics are not restricted to IT gurus, anyone can carry out computer forensics easily with the tools mentioned above.  Keep following LinuxHint for more tips and updates on Linux.

Sandclock IDC thành lập vào năm 2012, là công ty chuyên nghiệp tại Việt Nam trong lĩnh vực cung cấp dịch vụ Hosting, VPS, máy chủ vật lý, dịch vụ Firewall Anti DDoS, SSL… Với 10 năm xây dựng và phát triển, ứng dụng nhiều công nghệ hiện đại, Sandclock IDC đã giúp hàng ngàn khách hàng tin tưởng lựa chọn, mang lại sự ổn định tuyệt đối cho website của khách hàng để thúc đẩy việc kinh doanh đạt được hiệu quả và thành công.
Bài viết liên quan

Cài đặt Vuls trên ubuntu 18.04

Khi sử dụng hệ điều hành thì ta thường xuyên cài đặt các gói và các ứng dụng. Làm sao để...

How to Set a New Hostname for your Linux System

We all know that computers over a local area network are identified by IP addressed. Instead of expecting others to remember...

Install Oracle JDK 11 on CentOS 7

The latest LTS (Long Term Support) version of JDK (Java Development Kit) is version 11 which came out recently. JDK 8 and...
Bài Viết

Bài Viết Mới Cập Nhật

Hướng dẫn chuyển đổi windows server windows evaluation to standard và active windows server 2008 + 2012 + 2016 + 2019

How to Update Ubuntu Linux

Squid Proxy Manager cài đặt và quản lý Proxy Squid tự động trên ubuntu

Hướng dẫn cài đặt Apache CloudStack

Hướng dẫn ký file PDF bằng chữ ký số (chữ ký điện tử) và sửa lỗi mới nhất 2021 foxit reader