Looking to find the right tool for your forensic needs? Look no further.
This blog provides a computer forensic tools comparison for SOC teams, DFIR teams, and digital investigators, so that they can find the best tool for them.
Our comparison assesses 9 top tools using 6 different scores.
Let’s get started!
Jump to a section…
Definition of Computer Forensic Tools
Analysis Platforms
Your Next Investigation…
Definition of Computer Forensic Tools
Computer forensic tools are specialized software applications (or hardware) designed to conduct investigative procedures involving the examination of digital evidence recovered from hard drives, memory, and other storage devices.
In this blog, we will focus on the computer forensics tool category: analysis platforms.
Note
Defining computer forensic tools is not as straightforward as it sounds. They fall under the umbrella of digital forensics tools and also into smaller categories, such as incident response tools. For further details on the differences between these 3, you can read more here.
Computer Forensic Tools Comparison: Breaking Down 9 Analysis Platforms
Comparing analysis platforms is difficult. Each has different strengths and weaknesses and different approaches to processing and presenting data. To give our comparison structure, we’ve created a set of 6 scores we’ll assess the tools with: ingest speed, artifact coverage, automated analysis, automation, collaboration, and price. These scores are defined below. Hopefully, you can use these scores to help find the tool that best suits your needs.
If you disagree with any of the views expressed below, feel free to reach out to us on LinkedIn.
The Scores:
| Ingest Speed | This refers to the time it takes to process collected data and make it ready for analysis. Again, direct comparisons between tools are difficult because of the number of artifacts processed and the ability to choose what gets processed. For the purposes here, we have used the default software settings and feedback from online forums and reviews.
This score is out of 5. |
| Artifact Coverage | All tools listed here can process the core Windows artifacts, browser history, and some application data. The main differences lie in the volume of application data and in how some operating system information is presented.
For example, while most tools process Windows Event logs, the way they are presented varies significantly. In most cases, it is easier to export the logs and use a tool such as Microsoft’s Event Log Expert to conduct a more detailed analysis. On the other hand, Cyber Triage processes specific event log records and creates information artifacts from them, enabling easy integration into your analysis. This score is out of 5. |
| Automated Analysis | Automated Analysis is using computers to accelerate data interpretation. It uses filters, rules, and heuristics to identify significant items of interest in the data under investigation.
The most common approach to this is integrating Yara and Haybusa for post-processing. Other approaches include malware scanning, automated upload to sandboxes, internal heuristics within the tool, and machine learning. This score is out of 5. |
| Automation | Automation is using computers to accelerate data processing. It uses built-in programs or user scripts to make straightforward DFIR tasks faster.
This includes automating data ingestion and enabling users to script specific functions within the tool. This score is out of 5. |
| Collaboration | The ability to have multiple investigators working on the same case simultaneously.
This score is yes or no. |
| Price | Pricing information is based on publicly available information. Not all vendors publish prices; in such cases, estimates are based on publicly available information. Prices provided are for the basic single-user version of the software.
This is the listed price. |
Cyber Triage
Primary function: Cyber Triage was originally designed to rapidly identify signs of malicious activity on a system. It still does this, but its functionality has expanded over the years to include more in-depth analysis features. Its primary focus is to enable rapid analysis of potentially compromised systems and to track threat actor activity. It uses a novel approach to presenting information by normalizing data from all artifacts and consolidating related information into individual events. This avoids requiring the investigator to have in-depth knowledge of all source artifacts and reduces redundancy by consolidating related information.
Users: The “information artifact” approach makes Cyber Triage a great choice for both experienced investigators, who will find themselves completing investigations faster than they ever have before, and those with a basic understanding of digital forensics who will be guided to the most significant activity on the system.
| Category | Score | Details |
|---|---|---|
| Ingest Speed | 5/5 |
|
| Artifact Coverage | 3.5/5 |
|
| Automated Analysis | 5/5 |
|
| Automation | 4/5 |
|
| Collaboration | Yes |
|
| Price | $3,500 | N/A |
Cyber Triage is a computer forensic tool that specializes in rapid incident response, enabling investigators to quickly identify compromised hosts and make their next decisions fast.
1 For more detail on information artifacts see https://www.cybertriage.com/blog/information-artifacts-simplify-dfir-analysis/
2 Cyber Triage uploads hashes of recently used executables to Reversing Labs for rapid identification of known malware and good files. This feature is included in the license fee.
3 Hayabusa is an open source tool that uses SIGMA rules to identify event log entries of interest.
4 Yet Another Recursive Ancronym, or Yet Another Ridiculous Acronym is an open-source tool used to identify and classify malware, suspicious files, and IOCs.
Magnet AXIOM Cyber
Primary function: Magnet AXIOM Cyber is a deep-dive digital forensic tool that processes a wide range of artifacts. It provides some useful visualizations of endpoint activity and can correlate events from multiple sources.
Users: Magnet AXIOM Cyber is great for people conducting investigations across a wide range of platforms who want everything in one place and are willing to wait for results.
| Category | Score | Details |
|---|---|---|
| Ingest Speed | 2/5 |
|
| Artifact Coverage | 5/5 |
|
| Automated Analysis | 3/5 |
|
| Automation | 5/5 |
|
| Collaboration | Yes |
|
| Price | $12,000 |
|
5 Users need to download or develop their own hash sets.
6 Users need to download or develop their own Sigma rules.
7 Users need to download or develop their own YARA rules.
Autopsy
Primary function: Autopsy is the most popular open-source digital forensic platform. It has multiple plugins and an active community that maintains it. Autopsy was built by the same team that developed The Sleuth Kit, which is also the foundation of many commercial forensic tools.
Users: Autopsy is a great tool for those on a budget. It provides very similar functionality to the commercial offerings at a fraction of the price, nothing! With plugin support, it can be customized to parse new artifacts as they are encountered, along with extensive automation. It’s ideal for those looking for hands on computer forensic tools.
| Category | Score | Details |
|---|---|---|
| Ingest Speed | 4/5 |
|
| Artifact Coverage | 4/5 |
|
| Automated Analysis | 1/5 |
|
| Automation | 4/5 |
|
| Collaboration | No |
|
| Price | $0 |
|
8 With purchase of Cyber Triage extension.
Belkasoft X Corporate
Primary function: Belkasoft X’s primary function is advanced data extraction and artifact recovery with forensic imaging to preserve evidence in its original state. For law enforcement, Belkasoft X Forensic includes data collection and analysis from vehicle and drone devices.
Users: Investigators wanting visual representations and a read-only export option, and law enforcement.
| Category | Score | Details |
|---|---|---|
| Ingest Speed | N/A |
|
| Artifact Coverage | 4/5 |
|
| Automated Analysis | 3/5 | |
| Automation | 3/5 |
|
| Collaboration | Yes |
|
| Price | $7,500 |
|
OpenText Forensics (EnCase)
Primary function: EnCase’s primary function is supporting a wide array of devices to obtain data, disk analysis, and ingesting/parsing full disk images. There is also an enterprise version that supports remote analysis of endpoints via an agent.
Users: Corporate security people who want remote collection and analysis capabilities, and law enforcement.
| Category | Score | Details |
|---|---|---|
| Ingest Speed | 3/5 |
|
| Artifact Coverage | 4/5 |
|
| Automated Analysis | 2/5 |
|
| Automation | 3/5 |
|
| Collaboration | Yes |
|
| Price | $3,500 |
|
Nuix Workstation
Primary function: In its early days, Nuix was known as “the email tool,” but even then, it had one of the most effective indexing and text search capabilities. In addition to text search, it provides excellent support for Windows artifacts.
Users: Nuix is popular with those having to search and manage large volumes of data efficiently.
| Category | Score | Details |
|---|---|---|
| Ingest Speed | 3.5/5 |
|
| Artifact Coverage | 5/5 |
|
| Automated Analysis | 2/5 |
|
| Automation | 5/5 |
|
| Collaboration | Yes |
|
| Price | $20,000 to $1,000,000+ |
|
Exterro Forensic Toolkit (FTK)
Primary function: FTK is a deep-dive forensic analysis tool best known for the free Imaging tool FTK Imager. As with Encase, it offers a collaborative “Lab” edition and a single-user version. Its main strength is parsing operating system artifacts.
Users: Good for eDiscovery and law enforcement investigations.
| Category | Score | Details |
|---|---|---|
| Ingest Speed | 3/5 |
|
| Artifact Coverage | 4/5 |
|
| Automated Analysis | 3/5 |
|
| Automation | 4/5 |
|
| Collaboration | Yes |
|
| Price | $7,999 |
|
X-Ways Forensics
Primary function: X-Ways’ primary function is deep data recovery, digital imaging, and advanced analysis. Because of these functions, X-Ways is a well-known and established deep-dive forensics tool.
Users: X-Ways is the tool for the real experts. Those who understand how the operating system works and how users and applications interact with it.
| Category | Score | Details |
|---|---|---|
| Ingest Speed | 5/5 |
|
| Artifact Coverage | 4/5 |
|
| Automated Analysis | 1/5 |
|
| Automation | 4/5 |
|
| Collaboration | No |
|
| Price | $1,589 |
|
Forensic Explorer
Primary function: Forensic Explorer’s primary function is for law enforcement deep-dive data analysis. In particular, it offers file signature verification and live boot virtualization. Developed by former law enforcement digital forensics experts, this is a tool written by and for people who are conducting real investigations.
Users: For people on a budget, Forensic Explorer is an awesome value.
| Category | Score | Details |
|---|---|---|
| Ingest Speed | 4/5 |
|
| Artifact Coverage | 3/5 |
|
| Automated Analysis | 3/5 |
|
| Automation | 3/5 |
|
| Collaboration | No |
|
| Price | $2,695 |
|
Your Next Investigation…
Computer forensic tools are essential to most digital investigations as they are used for data collection and recovery, artifact analysis, investigative platforms, and reporting of data from hard drives, memory, and other storage devices. Further, analysis tools are needed to take your investigation to the next step by reducing manual labor and speeding up investigations.
For an analysis tool that specializes in rapid incident response, enabling investigators to quickly identify compromised hosts and make their next decisions fast, try Cyber Triage.
You can try it for free for 7 days here.
Check back as we build! Analysis tools are not the only type of computer forensic tool needed in your tech stack, and finding the right tools to fit is not an easy task. Come back to this blog as we continue to add to this computer forensic tools comparison blog.