Foremost

Foremost is a console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. Foremost can work on image files, su...
Language(s): C
Operating system(s): Linux
License: Public Domain (US Gov) Source code is available

The Coroner's Toolkit

The Coroner's Toolkit (or TCT) is a suite of free computer security programs by Dan Farmer and Wietse Venema for digital forensic analysis. The suite runs under several Unix-related operating systems:...
Language(s): N/A
Operating system(s): Unix, Linux
License: IBM Public License

The Sleuth Kit

The Sleuth Kit® (TSK) is a library and collection of command line tools that allow you to investigate disk images. The core functionality of TSK allows you to analyze volume and file system data. The ...
Language(s): C, Perl
Operating system(s): Unix, Linux, Windows
License: IPL, CPL, GPL

USBKill

USBKill is anti-forensic software distributed via GitHub, written in Python for the BSD, Linux and OS X operating systems. It is designed to serve as a kill switch if the computer on which it is insta...
Language(s): Python
Operating system(s): BSD, Linux, Mac OS X, other Unix-like systems
License: GNU General Public License