Tools file analysis
File analysis tooling for examining what a file contains and does - identifying file types from content, extracting and analyzing strings and documents, parsing structured artifacts, and observing the behavior of executables. The tools below are grouped according to the categories of analysis described in File analysis. Related tool categories include Document metadata extraction and Logfile analysis.
Warning: The tools listed below are not necessarily forensic tooling in the sense of Forensic tooling.
File format identification
See also File Format Identification.
Written in C. Rules in /usr/share/file/magic and compiled at runtime. Powers the Unix "file" command, but you can also call the library directly from a C program.
The file command determines the file type of a given file, depending on its contents and not on e.g. its extension or filename. In order to do that, it uses a magic configuration file that identifies filetypes.
Python framework for binary file manipulation. Determines the file type using file header/footer (hachoir-metadata --type), able to list strings in Unicode (hachoir-grep), etc. Support more than 60 file formats.
Project of the National Archives of the United Kingdom to develop a registry of file types.
JSTOR/Harvard Object Validation Environment, a similar registry of file formats started by JSTOR and Harvard. Attempts are now underway to merge these two efforts in the GDFR and the UDFR.
Digital Record Object Identification, an "automatic file format identification tool" developed by the UK National Archives. Written in Java.
Recognizes over 9,000 file formats with XML format definitions, compiled to a single container. New file types can be added in an automated way, simply scanning a group of files. Win32, Linux/x86 & x86-64; closed source; free for non-commercial use.
File and format identification tool with ECMAScript (JS) format definitions; reliably detects many weak/zero-magic formats by content only. Supports YARA rules, looks inside many compression formats, has extensive support of executable formats, disassembly that supports dozens of silicones, a file visualizer, a string finder, entropy analysis and a file extractor. Has a Telegram bot to send files to, and is one of the VirusTotal tools for executables. The engine is a separate project that can be easily reused. C++ and JS open source; Windows x32/64, Linux x32/64, Mac x64 GUI and CLI.
- Forensic Innovations File Investigator TOOLS
Proprietary, but free trial available. Available as consumer applications and OEM API. Identifies 3,000+ file types, using multiple methods to maintain high accuracy. Extracts metadata for many of the supported file types.
Proprietary but free demo.
Free. Runs in the browser. HTML5/JS port of the UNIX "file" tool and libmagic.
- Falstaff
Free, online. Based on machine learning techniques, uses multiple file features and novel signatures computed from file format samples. Identifications are linked to the file formats archive ontology.
Free (Apache v2.0 License). The Apache Tika™ toolkit detects and extracts metadata and text from over a thousand different file types.
Web-based file analysis service (see the Wikipedia article).
Content analysis
See also Strings analysis.
Strings will print the strings of printable characters in files. It allows choosing different charactersets (ASCII, UNICODE). It is a quick way to browse through files/partitions/... in order to look for words, filenames, keywords etc.
"...suite of programs that aims to help analyzing text data from PDF documents. It includes a PDF parser, a PDF renderer (though only rendering text is supported for now), and a couple of nice tools to extract texts. Unlike other PDF-related tools, it allows to obtain the exact location of texts in a page, as well as other layout information such as font size or font name, which could be useful for analyzing the document. It also infers text running within a page by using clustering technique."
Part of the Live-Forensics project: a command line tool that searches for strings in a given file, able to compare the output against a dictionary to either exclude dictionary terms from the output or only output files that match the dictionary. Also able to search for IP addresses and URLs/email addresses.
Free hex editor for Linux. Efficient editing of large data files and block devices, multilevel undo-redo, customizable data views, fast find and replace, a data conversion table, and highlighting of selection pattern matches in the file.
Executable file analysis
See also Executable and Analyzing program execution.
List dynamic dependencies of executable files.
Software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. The framework includes a suite of full-featured software analysis tools that enable users to analyze compiled code on Windows, Mac OS and Linux: disassembly, decompilation, graphing, and scripting. Supports a wide variety of processor instruction sets and executable formats, runs in user-interactive and automated modes, and can be extended with Java or Python plug-in components.
GUI-based program that runs under Windows and identifies more than 600 different signatures in portable executable files; supports custom plugins via its plugin interface.
Solaris tool used to trace the system/library calls (not user calls) and signals made/received by a new or existing process. It sends the output to stderr.
Library call tracer.
System Call Tracer.
eXtended trace utility, similar to strace, ptrace, truss, but with extended functionality and unique features, such as dumping function calls (dynamically or statically linked), dumping call stack and more.
- ktrace
Enables kernel process tracing on OpenBSD.
Executes a program under emulation, performing analysis according to one of the many plug-in modules as desired. You can write your own plug-in module as desired.
Comprehensive dynamic tracing framework for Solaris (also ported to Mac OS X - XRays and FreeBSD). DTrace provides a powerful infrastructure to permit analysis of the behavior of the operating system and user programs.
Code comparison
CodeSuite by Software Analysis & Forensic Engineering comprises BitMatch, CodeCross, CodeDiff, CodeMatch, and SourceDetective for comparing and analyzing source code and object code to find copyright infringement and trade secret theft. It can be used for free on small sets of code.
CodeSuite also includes FileCount and FileIsolate for counting file attributes and quickly copying or deleting entire file trees. Both are free utilities.
Artifact parsing
See also File formats.
MS Windows Recycle Bin INFO2 parser.
MS IE cookie file parser.
Python-based parser for binary property list (plist) files (macOS).
Library and applications to read the Windows SuperFetch Format; the project currently only provides documentation.
Free, open source desktop application for inspecting Exif metadata in image files and plotting the GPS coordinates stored in that metadata on a map. Local-first: parsing runs on the examiner's computer, with no user account or telemetry.
Utility that deletes or modifies timestamp-related information on files (MACE values); useful for understanding anti-forensic techniques that hide when a file was modified.
Parses the $MFT file system metadata of a NTFS file system and presents the results in multiple formats. Written in Python 2 and no longer maintained; a Python 3 fork is also unmaintained.
File sharing analysis
Tools to discover and analyze peer-to-peer files for Windows.
Email and structured file viewers
See also Personal folder file (PAB, PST, OST) and Extensible Storage Engine (ESE) database file (EDB) format.
Offers free viewers for AOL PFC, EDB, OST, PST and MBOX email files.
Offers free viewers for MBOX, MSG and Opera MBS email files, plus a forensic analysis tool for SQLite database files.
Repairs, recovers and restores corrupt Outlook PST files; recovered data can be saved as PST, EML, DBX, MBOX or MSG, preserving folder hierarchy and integrity of the data.
Products include an NSF Merge Tool, PST and OST file viewers, a DBX recovery tool, a DBX to PST converter, and SQL database, BKF and OST recovery tools. (Also see its data recovery tools.)
Products include viewers for E01, BKF, OST, Outlook PST, Exchange EDB, OLM, EML, SQL MDF and DXL files, the MailPro+ email viewer (14 desktop email clients), an NTFS log analyzer, and PST/OST reporters. (Also see its data recovery tools.)
Products include viewers for Outlook PST, Exchange EDB, OST, MBOX, OLM and EML files, an Outlook PST Reporter that generates file analysis reports (total item types, mail flow density by date or sender, user interactions), and password recovery tools.
Windows environments
See also Cygwin.
Linux like environment for Windows.
Common unix utilities compiled for a Windows environment.
Common GNU utilities compiled for a Windows Environment.