View source

; The Sleuthkit
:  The Sleuth Kit and Autopsy Browser. Both are open source digital investigation tools (a.k.a digital orensic tools) that run on Unix systems (such as Linux, OS X, FreeBSD, OpenBSD, and Solaris).  They can be used to analyze NTFS, FAT, Ext2, Ext3, UFS1, and UFS2 file systems and several volume system types.
: http://www.sleuthkit.org/
; HELIX
: Includes WFT (Windows Forensic Toolchest), FRU (First Responders Utility), IRCR2 (Incident Response Collection Report)
: http://www.e-fense.com/helix/
; Windows Sysinternals
: Security and system utilities most of them are useful for Computer Incident Response and Investigation
: http://www.microsoft.com/technet/sysinternals/default.mspx
; Foundstone tools 
: Security and system utilities most of which are also useful for Computer Incident Response and Investigation
: http://www.foundstone.com/us/resources-free-tools.asp
; Live View 
: Live View is a Java-based graphical forensics tool that creates a VMware virtual machine out of a raw (dd-style) disk image or physical disk. This allows the forensic examiner to "boot up" the image or disk and gain an interactive, user-level perspective of the environment, all without modifying the underlying image or disk. Because all changes made to the disk are written to a separate file, the examiner can instantly revert all of his or her changes back to the original pristine state of the disk. The end result is that one need not create extra "throw away" copies of the disk or image  to create the virtual machine.
: Live View is developed by CERT, Software Engineering Institute
: http://liveview.sourceforge.net/