Volatility

Forensicskali · parrot

Advanced memory forensics framework for analyzing RAM dumps.

Install

sudo apt install volatility

volatility -f memory.dmp imageinfo
volatility -f memory.dmp --profile=Win10x64 pslist

Use only on systems you are authorized to test. Follow program scope.

Autopsy

Digital forensics platform with GUI on top of The Sleuth Kit.

exiftool

Read and write meta information in files — useful for OSINT on documents and images.

foremost

File carving tool to recover files based on headers and footers.