foremost

Forensicskali · parrot

File carving tool to recover files based on headers and footers.

Install

sudo apt install foremost

foremost -i disk.img -o output/

Use only on systems you are authorized to test. Follow program scope.

Volatility

Advanced memory forensics framework for analyzing RAM dumps.

Autopsy

Digital forensics platform with GUI on top of The Sleuth Kit.

exiftool

Read and write meta information in files — useful for OSINT on documents and images.