Set up your forensics toolkit

One-run install

The scripts install the toolkit and print links for the tools that need a manual download.

powershell -ExecutionPolicy Bypass -File setup-windows.ps1

chmod +x setup-linux.sh && ./setup-linux.sh

What each track needs

Every case lists its suggested tools, and the guided worksheet prints a quick-start for each. Below is the toolkit by certification track, so you install only what you need.

Foundations & Windows Forensics

• Autopsy or The Sleuth Kit: disk images, deleted-file recovery, carving. Free.
• Eric Zimmerman's tools (PECmd, LECmd, JLECmd, RECmd, EvtxECmd, Timeline Explorer): Prefetch, LNK, jump lists, registry, event logs, timelines. They need the .NET runtime, which the Windows script installs. Free.
• Registry Explorer: registry hives (USB history, UserAssist, RecentDocs). Free.
• RegRipper: plugin reports from a hive, a quick second opinion on Registry Explorer. Free.
• Event Viewer (built into Windows) or Chainsaw: EVTX logon, account and log-clearing events. Free, Chainsaw is a hand-download.
• DB Browser for SQLite: Chrome history and the other SQLite databases in a case. Free.
• Browser History Viewer or Hindsight: browser history and downloads without writing SQL. Free.
• FTK Imager: mount and preview images. Free, hand-download (Exterro).
• Timesketch: optional, for super-timelines. A spreadsheet works too. Free.

Mobile Forensics

• ALEAPP: Android logs, events and app data. Free, hand-download.
• iLEAPP: iPhone extractions, including sms.db and the address book. Free, hand-download.
• DB Browser for SQLite: SMS, messaging-app, contacts and location databases. Free.

Network Forensics

• Wireshark / tshark: packet captures (DNS, HTTP payloads, beacons, cleartext credentials). Free.
• NetworkMiner: files, hosts and credentials pulled out of a capture. Free edition.

Cloud & SaaS and incident response

• jq or any JSON viewer: cloud audit logs (CloudTrail, M365, Azure sign-ins) and the EDR and SIEM exports. Free.
• A spreadsheet (Excel or LibreOffice Calc): sort and filter an alert queue or a sign-in log.
• Thunderbird: email mailboxes (mbox) and loose .eml. Free.

Advanced Forensics & IR

• Volatility 3: memory (processes, network connections, injected code). The first run on a Windows image needs internet to fetch the kernel symbols from Microsoft; after that it works offline. Linux images ship with their symbol table, so they work offline from the start. Free.
• Plus the Windows, mobile, network and cloud tools above; intrusion cases span several evidence types.

Prefer a ready-made distro?

SANS SIFT Workstation is a free, maintained Linux VM that bundles most of the above (Sleuth Kit, Volatility, Wireshark and more). For a clean, disposable analysis environment with nothing to install, download SIFT and point it at your lab's evidence.

SIFT covers the disk, memory, network and Linux tracks; the Linux cases are plain-text logs you read with grep and any editor, and two of them add a LiME memory image for Volatility 3. For Windows-artifact cases, add Eric Zimmerman's tools (under dotnet on Linux, or natively on a Windows VM). For macOS cases, the unified log is a log show text export you read with grep, the LaunchAgents are XML plists, and DB Browser opens the quarantine, Safari and TCC databases. mac_apt parses the same artifacts from a full macOS image.

Tools you download by hand

These aren't in winget, apt or PyPI, so the scripts print their links instead:

• FTK Imager: exterro.com (free, form required).
• Chainsaw: GitHub releases (free, EVTX threat hunting).
• ALEAPP: GitHub releases (free, Android).
• iLEAPP: GitHub releases (free, iPhone).