Forensic and data recovery
For files
- hachoir-subfile
- Photorec: File header and footer database, tools to sort file by content (eg. using EXIF metadata)
- Scalpel: fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files. Scalpel is a fork of Foremost.
- Foremost: console program to recover files based on their headers, footers, and internal data structures
- Magic Rescue: File header database, tools to recover file start (scripts using external program like gzip, mencoder, jpegtran, etc.)
- anyfs-tools: UNIX-way toolset for recovering and converting filesystems for Linux OS
- Autopsy Forensic Browser
For file systems
- TestDisk (Christophe GRENIER): recover lost partitions and make non-booting disks bootable again
- parted
- EXT2/EXT3: ext3rminator (Mike Hommey)
- EXT2/EXT3: giis (giis-get it i say)
- ddrescue (Antonio Diaz): special version of dd (copy from a device to a file), specific to read damaged hard drives. Try also dd_rescue by Kurt Garloff.
For file and file systems
For memory
Forensics websites
- www.forensicswiki.org: Great directory of forensics tools
- Digital Forensic Research Workshop (DFRWS)
- www.openrce.org: Windows programs (PE) reverge engineering
- lnx4n6.be : Linux Forensics and FCCU GNU/Linux Forensic Boot CD
