Search

Document / File OSINT Tools

OSINT tools that take document / file as input. Below are the 54 tools in our catalogue that take document / file as input, indexed by what they return so you can chain them together.

54tools
Browse with filters
Wireshark icon

Wireshark

Network protocol analyzer

FreeOSSDesktop AppCLI
IN
OUT
ALEAPP icon

ALEAPP

Android forensic artefact parser

FreeOSSCLI
IN
OUT
Andriller icon

Andriller

Android device forensic acquisition toolkit

FreemiumOSSDesktop App
IN
OUT
Apache Tika icon

Apache Tika

Extract text and metadata from any document type

FreeOSSCLIAPI
IN
OUT
Autopsy DFIR icon

Autopsy DFIR

Open-source disk forensics toolkit

FreeOSSCLI
IN
OUT
BANG (Binary Analysis Next Generation) icon

BANG (Binary Analysis Next Generation)

Recursive firmware unpacker

FreeOSSCLI
IN
OUT
BR's EXIFextracter icon

BR's EXIFextracter

Windows tool exporting photo EXIF metadata to CSV in bulk

FreeDesktop App
IN
OUT
Belkasoft Evidence Center X icon

Belkasoft Evidence Center X

Commercial DFIR acquisition and analysis suite

PaidDesktop App
IN
OUT
Binwalk icon

Binwalk

Firmware blob carving and analysis tool

FreeOSSCLI
IN
OUT
C2PA Verify icon

C2PA Verify

Verify C2PA Content Credentials and provenance in media

FreeWeb
IN
OUT
CapLoader icon

CapLoader

Batch PCAP triage workstation

PaidDesktop App
IN
OUT
Cellebrite UFED icon

Cellebrite UFED

Cellebrite mobile-forensic acquisition platform

PaidDesktop App
IN
OUT
Checkov icon

Checkov

Scan infrastructure-as-code for misconfigurations

FreeOSSCLI
IN
OUT
DocumentCloud icon

DocumentCloud

Upload, OCR and full-text search primary-source documents used by newsrooms

FreeWebAPI
IN
OUT
EMBA icon

EMBA

Embedded Linux firmware analyser

FreeOSSCLI
IN
OUT
Exifinfo icon

Exifinfo

Online EXIF and metadata viewer for images

FreeWeb
IN
OUT
Extract Metadata icon

Extract Metadata

Extract hidden metadata from files and images

FreeWeb
IN
OUT
FACT icon

FACT

Automated firmware-analysis platform

FreeOSSWebCLI
IN
OUT
Gephi icon

Gephi

Open-source network graph visualization and link-analysis platform

FreeOSSDesktop App
IN
OUT
Gitleaks icon

Gitleaks

a secrets detection tool for finding API keys, tokens, and credentials in rep

FreeOSSCLI
IN
OUT
Google Earth Pro icon

Google Earth Pro

Desktop Google Earth with historical imagery

FreeDesktop App
IN
OUT
Hachoir icon

Hachoir

Parse binary file structure and extract embedded metadata

FreeOSSCLI
IN
OUT
Hindsight Chrome Forensics icon

Hindsight Chrome Forensics

Chromium browser history forensics

FreeOSSCLIDesktop App
IN
OUT
Hive Moderation AI Detector icon

Hive Moderation AI Detector

AI-generated content detector

FreemiumWebAPI
IN
OUT
IOC Parser icon

IOC Parser

Extracts IOCs from PDF and HTML threat reports

FreeOSSCLI
IN
OUT
Internet Archive icon

Internet Archive

Digital library and web archive

FreeWebAPI
IN+1
OUT+1
Jotti's malware scan icon

Jotti's malware scan

Scans an uploaded file with multiple antivirus engines

FreeWeb
IN
OUT
MSAB XRY icon

MSAB XRY

MSAB mobile-forensic acquisition suite

PaidDesktop App
IN
OUT
Magnet AXIOM icon

Magnet AXIOM

Magnet Forensics DFIR investigation suite

PaidDesktop App
IN
OUT
MetaDefender Cloud icon

MetaDefender Cloud

Multi-engine scan of files, hashes, IPs and URLs

FreemiumWebAPI
IN+1
OUT
NetworkMiner icon

NetworkMiner

Passive PCAP network forensic analyser

FreemiumDesktop App
IN
OUT
New OCR icon

New OCR

Recognise text in images and PDFs online

FreeWeb
IN
OUT
OCRmyPDF icon

OCRmyPDF

Add a searchable OCR text layer to scanned PDFs

FreeOSSCLI
IN
OUT
ODCrawler icon

ODCrawler

Search engine across open directories for exposed files

FreeWeb
IN
OUT
OnlineOCR icon

OnlineOCR

Extract text from scanned PDFs and images via OCR

FreemiumWeb
IN
OUT
OpenRefine icon

OpenRefine

Browser app to clean, reconcile and augment messy tabular datasets

FreeOSSWebDesktop App
IN
OUT
Oxygen Forensic Detective icon

Oxygen Forensic Detective

Oxygen mobile and cloud DFIR suite

PaidDesktop App
IN
OUT
Plaso icon

Plaso

Forensic super-timeline engine

FreeOSSCLI
IN
OUT
Pywb icon

Pywb

Python Wayback-style WARC replay engine

FreeOSSCLIWeb
IN
OUT
QGIS icon

QGIS

Free desktop GIS for analyst workflows

FreeOSSDesktop AppCLI
IN
OUT
ReplayWeb.page icon

ReplayWeb.page

Client-side WARC/WACZ archive player

FreeOSSWeb
IN
OUT
Sintelix icon

Sintelix

Text analytics that extracts entities and link charts from documents

PaidDesktop AppWeb
IN
OUT
Suricata icon

Suricata

Open-source IDS/IPS engine

FreeOSSCLI
IN
OUT
TShark icon

TShark

Command-line packet analysis tool

FreeOSSCLI
IN
OUT
Tabula icon

Tabula

Extract tables from text-based PDFs into CSV or Excel

FreeOSSDesktop App
IN
OUT
Teleparser icon

Teleparser

Parses Telegram cache4.db into readable chats and contacts

FreeOSSCLI
IN
OUT
TruffleHog icon

TruffleHog

a secrets scanner for finding leaked credentials in code repositories, files,

FreemiumOSSCLI
IN
OUT
Zeek icon

Zeek

Network security monitor and parser

FreeOSSCLI
IN
OUT
iLEAPP icon

iLEAPP

iOS forensic artefact parser

FreeOSSCLI
IN
OUT
iMazing Acquisition icon

iMazing Acquisition

iOS forensic acquisition and backup tool

FreemiumDesktop App
IN
OUT
iVerify icon

iVerify

Mobile spyware and config scanner

FreemiumMobile App
IN
OUT
iocextract icon

iocextract

Extracts and refangs IOCs from arbitrary text

FreeOSSCLIAPI
IN
OUT
oletools icon

oletools

Analyse Office/OLE files for macros, objects and metadata

FreeOSSCLI
IN
OUT
tcpdump icon

tcpdump

Command-line packet capture utility

FreeOSSCLI
IN
OUT

Find specific data from document / file

Report / Summary36IOC (Indicator of Compromise)15EXIF Data7Timeline / Chronology6

Investigate by other data types

Email AddressPhone NumberUsernameReal NameIP AddressDomain NameCryptocurrency WalletImage / PhotoURLHash (MD5/SHA)Company NameMalware Sample