The Toolkit
Digital Forensics
Digital forensics is the investigative side of the toolkit: examining systems and data to recover what happened, what was there, and what someone tried to hide. It spans memory analysis (pulling processes, network connections, and secrets out of a RAM dump), disk forensics (timelines, deleted-file recovery, filesystem archaeology), file examination (metadata, carving, steganography), and privacy work (stripping metadata before you share something). It’s used for incident response, malware analysis, evidence recovery, and CTF forensics challenges alike.
| Tool | Source | What it’s for |
|---|---|---|
| volatility3 | official | Memory forensics — analyze RAM dumps for processes, secrets, and artifacts. |
| sleuthkit | AUR | The command-line disk and filesystem forensics toolkit. |
| autopsy | AUR | A graphical case-management front end over The Sleuth Kit. |
| testdisk | official | Recover lost partitions and deleted files (with PhotoRec). |
| foremost | official | Carve files out of a disk image by their signatures. |
| exiftool | official | Read and write metadata in almost any file type. |
| mat2 | official | Strip metadata from files before sharing them. |
| steghide | official | Hide data inside images and audio — and recover it. |
All live under Security → Digital Forensics.