Document / File OSINT Tools

Wireshark

Network protocol analyzer

ALEAPP

Android forensic artefact parser

AccessData FTK

Exterro/AccessData FTK forensic platform

Andriller

Android device forensic acquisition toolkit

Apache Tika

Extract text and metadata from any document type

Autopsy DFIR

Open-source disk forensics toolkit

BANG (Binary Analysis Next Generation)

Recursive firmware unpacker

BR's EXIFextracter

Windows tool exporting photo EXIF metadata to CSV in bulk

Belkasoft Evidence Center X

Commercial DFIR acquisition and analysis suite

Binwalk

Firmware blob carving and analysis tool

Brim

Open desktop tool for PCAP and Zeek search

Bulk Extractor

High-speed disk-image artifact carver

C2PA Verify

Verify C2PA Content Credentials and provenance in media

CapLoader

Batch PCAP triage workstation

Cellebrite UFED

Cellebrite mobile-forensic acquisition platform

Checkov

Scan infrastructure-as-code for misconfigurations

DocumentCloud

Upload, OCR and full-text search primary-source documents used by newsrooms

EMBA

Embedded Linux firmware analyser

Exifinfo

Online EXIF and metadata viewer for images

Extract Metadata

Extract hidden metadata from files and images

FACT

Automated firmware-analysis platform

FOCA

Extract hidden metadata from an organization's public documents

Gephi

Open-source network graph visualization and link-analysis platform

Get-Metadata

View hidden EXIF and document metadata from an uploaded file

Gitleaks

a secrets detection tool for finding API keys, tokens, and credentials in rep

Google Earth Pro

Desktop Google Earth with historical imagery

Hachoir

Parse binary file structure and extract embedded metadata

Hindsight Chrome Forensics

Chromium browser history forensics

Hive Moderation AI Detector

AI-generated content detector

IOC Parser

Extracts IOCs from PDF and HTML threat reports

Internet Archive

Digital library and web archive

Jotti's malware scan

Scans an uploaded file with multiple antivirus engines

MSAB XRY

MSAB mobile-forensic acquisition suite

Magnet AXIOM

Magnet Forensics DFIR investigation suite

MetaDefender Cloud

Multi-engine scan of files, hashes, IPs and URLs

NetworkMiner

Passive PCAP network forensic analyser

New OCR

Recognise text in images and PDFs online

OCRmyPDF

Add a searchable OCR text layer to scanned PDFs

ODCrawler

Search engine across open directories for exposed files

OnlineOCR

Extract text from scanned PDFs and images via OCR

OpenRefine

Browser app to clean, reconcile and augment messy tabular datasets

Oxygen Forensic Detective

Oxygen mobile and cloud DFIR suite

PacketTotal

Analyse an uploaded PCAP for hosts, files and IOCs

Plaso

Forensic super-timeline engine

Pywb

Python Wayback-style WARC replay engine

QGIS

Free desktop GIS for analyst workflows

ReplayWeb.page

Client-side WARC/WACZ archive player

Sintelix

Text analytics that extracts entities and link charts from documents

Suricata

Open-source IDS/IPS engine

TShark

Command-line packet analysis tool

Tabula

Extract tables from text-based PDFs into CSV or Excel

Teleparser

Parses Telegram cache4.db into readable chats and contacts

TruffleHog

a secrets scanner for finding leaked credentials in code repositories, files,

Zeek

Network security monitor and parser

iLEAPP

iOS forensic artefact parser

iMazing Acquisition

iOS forensic acquisition and backup tool

iVerify

Mobile spyware and config scanner

iocextract

Extracts and refangs IOCs from arbitrary text

oletools

Analyse Office/OLE files for macros, objects and metadata

tcpdump

Command-line packet capture utility