The Sleuth Kit

Advanced memory forensics framework. Extracts artifacts from RAM dumps — processes, network connections, registry.

Digital forensics platform with GUI. Disk image analysis, timeline analysis, keyword search, hash filtering.

NSA's reverse engineering framework. Disassembly, decompilation, graphing, and scripting for binary analysis.

Firmware analysis tool. Searches binary images for embedded files, executables, and file systems.

Pattern matching swiss knife for malware researchers. Create rules to identify and classify malware samples.

Endpoint visibility and collection tool. Hunt for artifacts across thousands of endpoints simultaneously.