+ Learn more about the FOSS DFIR Tools Framework and our mission. +
++ The FOSS DFIR Tools Framework serves as a comprehensive hub for digital forensics and incident response professionals. + We curate and organize open-source tools to make them easily discoverable and accessible to the security community. + Our platform bridges the gap between scattered tool documentation and practical implementation in academic and + professional environments. +
+ ++ Our tool categorization follows the standard DFIR methodology established by Kent, Chevalier, Grance, and Dang + in the NIST Special Publication 800-86. This systematic approach ensures that tools are organized according to + their primary function within the investigation process: +
++ Tools for acquiring and preserving digital evidence while maintaining chain of custody and ensuring data integrity. +
++ Tools for extracting, parsing, and organizing data from collected evidence in preparation for analysis. +
++ Tools for correlating, analyzing, and interpreting evidence to draw conclusions and identify patterns. +
++ Tools for documenting findings, creating timelines, and generating comprehensive investigation reports. +
++ This framework was designed specifically for academic and laboratory environments where self-hosted solutions + are preferred over cloud-based services. We emphasize tools that can be deployed locally, ensuring data sovereignty + and compliance with institutional policies. Our "Self-Hosted Services" section provides access to powerful platforms + like Timesketch, TheHive, and MISP that can be deployed within your network perimeter. +
+ ++ This platform is maintained by the DFIR community, for the DFIR community. We welcome contributions, + suggestions, and feedback to help improve the framework and keep tool information current. The entire + platform is built using static site generation with YAML-driven content management, making it easy for + contributors to add new tools or update existing information through simple file edits. +
+ +src/_data/tools.yaml to add or update tool informationsrc/_data/services.yaml to configure service monitoring+ Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). + Guide to integrating forensic techniques into incident response. + NIST Special Publication 800-86. National Institute of Standards and Technology. +
++ Welcome to the comprehensive directory of Free and Open Source Software (FOSS) tools for Digital Forensics and Incident Response. + This framework organizes tools according to the standard DFIR methodology: Data Collection, Examination, Analysis, and Reporting. + Use the selectors below to discover tools that match your specific needs, or explore the complete matrix view to see the full ecosystem. +
++ Choose a forensics domain and/or DFIR phase above to discover relevant tools, + or use the search bar to find specific tools. +
++ Lab Instance: + ${tool.serviceUrl} +
+${tool.description}
+ + ${serviceInfo} + +${tool.description}
+No services configured
+${service.issues}
+${service.description}
` : ''} ++ Ich stehe für Privatsphäre und Datenschutz und gehe damit transparent um. +
++ Letztes Update: 13.07.2025 +
++ Auf dieser Webseite werden nur minimale technisch nicht vermeidbare Dsten gesammelt. Diese Plattform agiert nach dem Prinzip privacy-first und existiert als statische Website ohne Datenaggregation durch den Server. +
+ ++ Der Browserspeicher wird minimalistisch und nur zu o.g. Zwecken genutzt. Wir speichern keine Cookies. +
+ +| Storage Type | +Purpose | +Retention | +
|---|---|---|
| Theme Preference | +Remember your dark/light mode choice | +Until manually cleared | +
| Search Filters | +Maintain search state during session | +Session only | +
+ Links to external tools (GitHub repositories, project websites) are provided for convenience. + These external sites have their own privacy policies and data handling practices. +
++ The "Self-Hosted Services" section links to services deployed within your local network. + Data handling for these services is governed by your institution's policies and the + specific configuration of each service. + Die als "on-premise" getaggten oder sonst offensichtlich gemachten Dienste werden innerhalb des CC24-Clusters (Teil des Mikoshi Compute Clusters) gehostet. + Jegliche Dateneingabe oder -verarbeitung unterliegt der Verantwortung des Nutzers, der die Daten erstmalig einbringt. Werden Vorschriften bestimmter Organisationen, die mit Ihnen in Verbindung stehen, berührt, sind Sie allein dafür verantwortlich, was Sie hochladen und verarbeiten. + Daten, deren Besitz strafbar ist, werden nicht toleriert. +
++ Ich implementiere zeitgemäße technische Maßnahmen, um Ihre Daten zu schützen: +
+ ++ Real-time status of our deployed DFIR SaaS services and infrastructure components. +
++ Checking service status... +
++ Connect your Uptime Kuma instance for real-time monitoring data. +
+Configuration: Edit src/_data/services.yaml to enable integration
API Endpoint: Not configured
+Last updated: Never
+ +