DFIR - 14 Free Tools
Digital Forensics & Incident Response Tools - from memory imaging and artifact analysis to automated timeline reconstruction and live response triaging. Turn chaotic security incidents into structured, evidence-backed investigations.
Live Response Triage Collector
Build custom triage scripts for volatile data, processes, network connections, and event logs.
KAPE Target & Module Builder
Generate KAPE commands for MFT, Registry, Evtx, and processing modules.
EvtxECmd Command Generator
Generate EvtxECmd commands for parsing Windows Event Logs at scale.
MFT Timestamp Analyzer
Detect timestomping by comparing $SI vs $FN timestamps in MFT records.
Amcache & Shimcache Analyzer
Map historical application execution from registry artifacts.
Browser History Timeline
Consolidate Chrome, Edge, Firefox history into a master timeline.
Volatility 3 Command Composer
Build Volatility 3 commands for memory analysis objectives.
YARA Rule Builder
Create YARA rules and scan commands for memory dumps.
Process Injection Detector
Identify process hollowing and thread injection indicators.
WMI & Scheduled Task Auditor
Parse scheduled tasks and WMI subscriptions for persistence.
Event 4624 Logon Parser
Map lateral movement from Windows authentication logs.
Service Creation Tracker
Analyze Event 7045 for malicious service installations.
Web Shell Investigation Pack
Analyze IIS, Apache, Nginx logs for web shell activity.
Cloud Forensics Matrix
Investigation steps for AWS, Azure, and M365 incidents.
Anti-Forensics Defeat
Counter log clearing, timestomping, and evidence destruction.
// CONFIGURE TRIAGE SCRIPT
// SELECT KAPE TARGETS
// CONFIGURE EVTXECMD
// MFT TIMESTAMP ANALYZER
Paste MFT record data (from MFTECmd CSV output) or enter file details manually to detect timestomping.
// TIMESTOMPING INDICATORS
$SI vs $FN Mismatch
$STANDARD_INFORMATION timestamps can be modified by attackers. $FILE_NAME timestamps are harder to change. A mismatch is a strong indicator.
Nanosecond Precision
Legitimate OS files have nanosecond precision. Timestomped files often show .0000000 - a tool artifact.
Impossible Timestamps
$SI Created AFTER $SI Modified, or timestamps predating the OS installation date.
Suspicious Paths
Files in %TEMP%, %APPDATA%, or Recycle Bin with timestamps matching legitimate system files.
// PASTE AMCACHE CSV DATA
// KEY AMCACHE LOCATIONS
| Artifact | Path | Evidence |
|---|---|---|
| Amcache.hve | C:\Windows\AppCompat\Programs\ | First execution time, SHA1, file path |
| Shimcache (AppCompatCache) | SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache | Execution order, last modified time |
| Prefetch | C:\Windows\Prefetch\*.pf | Run count, last 8 run times, loaded DLLs |
| BAM/DAM | SYSTEM\CurrentControlSet\Services\bam\State\UserSettings | Last execution time per user (Win10+) |
// PASTE BROWSER HISTORY (CSV FORMAT)
// BROWSER ARTIFACT LOCATIONS
| Browser | History DB Path | Table |
|---|---|---|
| Chrome | %LOCALAPPDATA%\Google\Chrome\User Data\Default\History | urls, visits |
| Edge | %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History | urls, visits |
| Firefox | %APPDATA%\Mozilla\Firefox\Profiles\*.default\places.sqlite | moz_places, moz_historyvisits |
// BUILD VOLATILITY COMMAND
// COMMON VOLATILITY 3 PLUGINS
| Plugin | Purpose | Key Output |
|---|---|---|
| windows.pslist | List running processes | PID, PPID, name, offset |
| windows.malfind | Find injected code | VAD regions with RWX, PE headers |
| windows.netscan | Network connections | Local/remote IP:port, PID, state |
| windows.cmdline | Process command lines | Full command with arguments |
| windows.dlllist | Loaded DLLs per process | DLL path, base address |
| windows.hashdump | Extract NTLM hashes | Username:RID:LM:NTLM |
| windows.filescan | Scan for file objects | File paths in memory |
| windows.handles | Open handles | Files, registry keys, mutexes |
// YARA RULE BUILDER
// PROCESS INJECTION INDICATORS CHECKER
// INJECTION TECHNIQUE REFERENCE
Process Hollowing
Legitimate process created suspended, memory unmapped, malicious PE written in. Indicators: unbacked memory, mismatched PE headers.
vol windows.malfind --pid TARGET_PIDDLL Injection
Malicious DLL loaded into target process via CreateRemoteThread + LoadLibrary. Indicators: unexpected DLL in dlllist, unsigned DLL.
vol windows.dlllist --pid TARGET_PIDReflective DLL Injection
DLL loads itself from memory without touching disk. Indicators: private RWX memory region with PE header (MZ).
vol windows.malfind | grep MZThread Hijacking
Existing thread context modified to execute shellcode. Indicators: thread start address in unbacked memory.
vol windows.threads --pid TARGET_PID// SCHEDULED TASK ANALYZER
// WMI PERSISTENCE COMMANDS
List WMI Subscriptions
Get-WMIObject -Namespace root\subscription -Class __EventFilter
Get-WMIObject -Namespace root\subscription -Class __EventConsumer
Get-WMIObject -Namespace root\subscription -Class __FilterToConsumerBindingRemove WMI Persistence
Get-WMIObject -Namespace root\subscription -Class __EventFilter | Remove-WMIObject
# Repeat for Consumer and BindingSuspicious WMI Indicators
CommandLineEventConsumer with encoded PowerShell, ActiveScriptEventConsumer with VBScript, subscriptions surviving reboots.
WMI Forensic Artifacts
C:\Windows\System32\wbem\Repository\ - OBJECTS.DATA, INDEX.BTR. Parse with python-cim or WMI-Forensics.
// PASTE 4624 LOG DATA
// LOGON TYPE REFERENCE
| Type | Name | Description | Forensic Significance |
|---|---|---|---|
| 2 | Interactive | Local keyboard/console logon | Physical access or RDP console |
| 3 | Network | SMB, net use, mapped drives | Lateral movement via SMB/PsExec |
| 4 | Batch | Scheduled task execution | Persistence mechanism activity |
| 5 | Service | Service startup | Malicious service installation |
| 7 | Unlock | Workstation unlock | Physical presence indicator |
| 10 | RemoteInteractive | RDP logon | Remote access - key lateral movement |
| 11 | CachedInteractive | Cached credentials logon | Offline/disconnected logon |
// PASTE EVENT 7045 DATA
// WEB LOG ANALYZER
// WEB SHELL INDICATORS
Suspicious URI Patterns
POST requests to image directories, .php/.aspx in upload folders, requests to files with no GET history.
Anomalous User Agents
curl, python-requests, empty UA, or UA strings with cmd.exe artifacts. Attackers often forget to set UA.
POST Volume Spike
Single IP sending many POST requests to same URI - interactive shell session pattern.
Response Size Anomalies
Consistent 200 OK with varying response sizes from same URI - command output being returned.
// SELECT CLOUD PLATFORM
// ANTI-FORENSICS INDICATOR CHECKER
// ANTI-FORENSICS DETECTION REFERENCE
| Technique | Attacker Action | Forensic Counter |
|---|---|---|
| Log Clearing | wevtutil cl Security | EID 1102 in Security log, EID 104 in System log |
| Timestomping | Modify $SI timestamps via API | Compare $SI vs $FN timestamps in MFT |
| VSS Deletion | vssadmin delete shadows /all | EID 8222, check VSS service logs |
| USN Journal | fsutil usn deletejournal /D C: | Gap in USN sequence numbers |
| Prefetch Disable | Registry: EnablePrefetcher=0 | Registry key modification timestamp |
| Secure Delete | SDelete, Eraser, cipher /w | Tool execution in Amcache/Prefetch |
| Memory-only Malware | No file written to disk | Volatility malfind, process hollowing |
Live Response Triage focuses on speed and volatility - it targets high-value forensic artifacts (RAM, active network connections, running process strings, and system event logs) while the machine is still running, taking only minutes. Full Disk Imaging clones the entire physical drive sector-by-sector, usually with the machine powered down, to preserve everything including deleted files and unallocated space. Responders use triage collection to quickly contain an ongoing attack across dozens of endpoints, saving full disk imaging for deeper, targeted analysis or legal chain-of-custody scenarios.
Timeline analysis arranges all host and network artifacts (file creations, registry modifications, web log hits, and event IDs) into a single chronological sequence. Attacks rarely consist of a single isolated action - they are chains of events. By merging different sources into a master timeline, an investigator can pinpoint exactly what occurred seconds before and after an alert fired. This helps differentiate automated system actions from manual attacker behavior and reveals the precise duration of the compromise.
Anti-forensics are actions taken by attackers to intentionally hide, alter, or destroy evidence. Common techniques include timestomping (modifying file timestamps to blend in with legitimate OS files), clearing event logs, deleting USN journals, or running malware purely in memory without writing to disk. To counter this, DFIR professionals look for structural gaps or mismatched metadata - such as event log gaps, discrepancies between MFT attributes, or orphan processes running in memory without an associated file execution trail.