Windows Forensics Tools

Browser Forensics

• Hind Sight
  Analyze browser history.
  

• Chrome History Analyzer
  Tool for Chrome browser analysis.
  

• Web Browser Forensic Tool
  Supports multiple browsers.
  

---

Event Log Forensics

• LogParser
  Parses Windows event logs.
  

• Event Log Explorer
  Comprehensive event log viewer.
  

• EvtxECmd (Eric Zimmerman)
  Fast parsing of EVTX event logs.
  

---

Registry Analysis

• RegRipper
  Extracts useful information from Windows registry.
  

• Registry Explorer (Eric Zimmerman)
  Advanced registry analysis.
  

• RECmd (Eric Zimmerman)
  Command-line registry analysis.
  

---

Memory Forensics

• Volatility
  Framework for memory analysis.
  

• Rekall
  Memory forensics and analysis.
  

---

File System Analysis

• FTK Imager
  Imaging and forensic analysis.
  

• Autopsy
  File system analysis and reporting.
  

• MFTECmd (Eric Zimmerman)
  MFT table analysis.
  

---

Timeline Analysis

• Plaso/Log2Timeline
  Framework for forensic timelines.
  

• Timesketch
  Collaborative timeline analysis.
  

---

Network Forensics

• Wireshark
  Network packet analyzer.
  

• NetworkMiner
  Network forensic analysis tool.
  

---

Disk Analysis

• X-Ways Forensics
  Comprehensive disk analysis tool.
  

• DiskDigger
  Data recovery and analysis.
  

---

Malware Analysis

• Cuckoo Sandbox
  Automated malware analysis.
  

• YARA
  Pattern matching for malware detection.
  

---

Email Forensics

• MailXaminer
  Comprehensive email analysis.
  

• P2 Commander
  Email investigation tool.