Tags -
AIX
Aix 
Bash shell 
Bzip2 
Ilook 
Zip 
Abandoned
4n6time 
Analyzemft 
Digital forensics framework 
Net/FSE: Network Forensic Search Engine 
Oxygen pm ii 
Safeback 
Simis 
Spada 
Active Directory
Active directory 
Analysis
Backtrack 
Belkasoft evidence center 
Caine live cd 
Dbx recovery tool 
Dbx to pst converter 
Disk explorer 
Driver viewer 
E01 viewer 
Exchange edb viewer 
Java 
Kernel bulk image resizer 
Kernel for eml viewer 
Kernel for exchange edb viewer 
Kernel for hotmail msn password 
Kernel for ie password 
Kernel for mbox viewer 
Kernel for olm viewer 
Kernel for ost viewer 
Kernel for outlook express password recovery 
Kernel for outlook password recovery 
Kernel for outlook pst reporter 
Kernel for outlook pst viewer 
Kernel for outlook to pdf 
Kernel for password unmask 
Kernel for pst add 
Kernel yahoo archive reader 
Libesedb 
Libevt 
Libevtx 
Libfsntfs 
Libfvde 
Liblnk 
Libmsiecf 
Libnk2 
Libnsfdb 
Libolecf 
Libpff 
Libpst 
Libregf 
Libscca 
Libuna 
Libvshadow 
Libvslvm 
Libwrc 
Libwtcdb 
Logfile analysis 
Malware analysis 
Microsoft office 
Microsoft outlook 
Msg viewer 
Nsf merge tool 
Ntfs log analyzer 
Olm viewer 
Ost file viewer 
Ost recovery tool 
Ost viewer 
Outlook pst viewer 
Registryasxml 
Sql database recovery tool 
Thumbnailexpert 
Xplico 
Analysis Techniques
File analysis 
Memory analysis 
Textual analysis 
Android
Android 
Fast thunder 
Sqlite 
TWRP (Team Win Recovery Project) 
Various methods to disassemble dex files 
Anti Virus
Kaspersky anti virus 
Microsoft security essentials 
Sophos antivirus 
Symantec antivirus 
Anti-Forensics
Air 
Anti forensic techniques 
Conventional File Systems 
Darik's boot and nuke 
Dd 
Diskcryptor 
Eraser 
Filevault disk encryption 
Full volume encryption 
Gbde 
Geli 
Linux unified key setup (luks) 
Proxy server 
Slacker 
Tcpdpriv 
The onion router 
Timestomp 
Truecrypt 
Vpn 
Window washer 
Windows encrypted file system 
Wipe 
Anti-forensics tools
Steganos privacy suite 
Applications
Google chrome 
Internet explorer 
Kaspersky anti virus 
Microsoft defender advanced hunting 
Microsoft security essentials 
Mozilla firefox 
Opera 
Sophos antivirus 
Archive
Appledouble header file 
Bzip2 
Cabinet archive format (cab) 
Cpio 
Gfzip 
Rar 
Seqbox 
Sgzip 
Tar 
Zip 
Articles that need to be expanded
$mft 
Academic forensics programs graduate level 
Acls 
Active directory 
Advanced Forensic Framework 4 (AFF4) 
Aes 
Afconvert 
Aff 
Afis 
Afxml 
Aid4mail 
Air force computer emergency response team 
Air force office of special investigations 
Aix 
Alarmdisk 
Algorithms 
Amcache 
Analyzing program execution 
Android 
Anonymous web browsing tools 
Anycast relay 
Aol pfc 
Apm 
Apparmor 
Apple inc 
Apple iphone 
Apple mail 
Apple mail header format 
Appledouble header file 
Application footprint xml 
Approximate matching 
Arff 
Ascii 
Ascription 
Asr data 
Ata raw 
Audio devices 
Autopsy forensic browser 
Autopsy forensic browser, version 2 
Background debug mode 
Bash shell 
Basic security module (bsm) file format 
Bcwipe 
Binnavi 
Binplist 
Biometrics 
Blackbag 
Blackhat (conference) 
Bmp 
Body File 
Bsd 
Bulk extractor viewer 
Bus 
Cabinet archive format (cab) 
Carver 2.0 planning page 
Ccleaner 
Cell phones 
Cell site analysis 
Chrome disk cache format 
Cloud forensics 
Codesuite 
Compiling open source forensic tools with mingw 
Computer forensics framework 
Converting binary plists 
Cpio 
Creating a VM control file from a forensic image 
Cross drive analysis 
Cygwin 
Data mining 
Data storage media 
Dco and hpa 
Deepspar 
Department of justice computer crime and intellectual property section 
Digital intelligence 
Disk image 
Disk images 
Disk imaging 
Dna 
Docex 
Domainkeys identified mail 
Domex 
Dstrings 
Dtsearch 
E01 viewer 
Educational resources for teaching computer forensics 
Email analysis 
Email detective forensic software tool 
Eml viewer 
Encapsulated postscript (eps) 
Encase 
Encase hash map 
Encfs 
Encyclopedia forensica 
Endianness 
Enisa 
Enscripts 
Epilogue to gutmann's 1996 paper 
Eric zimmerman 
Exif 
Exiftool 
Extended file system (ext) 
Face recognition 
Fernico 
File access conditions 
Filevault disk encryption 
Flash ide adapters 
Fookes software 
Forensic computers 
Gfzip 
Gnome 
Gnome desktop environment 
Guidance software 
Hachoir 
Hard drive 
Hard drive passwords 
Hash 
Hashing 
Header 
Html 
Imphash 
Infinadyne 
Insider threat 
International business machines corporation 
Internships 
Ip addresses in webmail messages 
Iximager 
Jffs2 
Jhead 
Knoppix 
Konqueror 
Linux logical volume manager (lvm) 
Linux logs analysis 
List of windows mru locations 
Logicube 
M3 data recovery 
Mac os x 
Machine translation 
Macos process monitoring 
Macquisition boot cd 
Mailing lists 
Mbox viewer 
Media sanitizing 
Metaspike 
Microsoft 
Microsoft mail header format 
Microsoft sql server compact edition (sqlce) database files (sdf) 
Multihashing 
Nasa office of the inspector general 
Naval criminal investigative service 
Online resources 
Ontario provincial police department 
Other Information 
Oxygen forensic suite 
P2pmarshal 
Paraben's email examiner 
Pcap 
Pdfinfo 
Peid 
Peter gutmann 
Piecewise hashing 
Portable executable format 
Powershell 
Prefetch 
Printers 
Prodiscover 
Prodiscover image file format 
Programming 
Psp 
Pysim 
Python 
Pytsk 
Qcow image format 
Raid 
Readyboost 
Readyboot 
Recovering bad data 
Recovering deleted data 
Recovering overwritten data 
Recovery is possible 
Recyclereader 
Red curtain 
References 
Refit 
Regimented potential incident examination report 
Reiserfs 
Remnant data 
Reports 
Residual data in document files 
Sanitization standards 
Sans institute 
Sans investigative forensic toolkit workstation 
Scalpelcp 
Sccm 
Sector hashing 
Setup api logs 
Sgzip 
Simreader 
Skype 
Slack 
Slacker 
Smart 
Sounds 
Spinrite 
Spyware 
Sql mdf viewer 
Sqlite 
Sqlite database format 
Sun microsystems inc 
Superfetch 
Symantec antivirus 
Systemd 
TWRP (Team Win Recovery Project) 
Tape 
Tcc database 
Tcpdpriv 
The bat header format 
Tiff 
Timestomp 
Tools memory analysis 
Tools vision 
Tskfuse 
Ufs tornado 
Umpc 
Unique 
Unix file system (ufs) 
Upcomingevents 
Upsec 08 
Url 
User account control (uac) 
Usnjrnl 
Video devices 
Vinetto 
Virtual disk image (vdi) 
Virtual hard disk (vhd) 
Virtualization memory analysis 
Vizsec 
Vmware 
Volatile systems 
Warrant 
Web browser 
Web browser history 
Web historian 
Webmining 
Wetstone technologies inc 
Wiebetech 
Win32.shiz 
Window washer 
Windows forensic toolchest 
Windows storage spaces 
Windows update 
Wipe 
Wireless forensics 
Wireless security 
Wmi 
Xfs 
Xml 
Xmount 
Xpdf 
Xz 
Zero storage carving 
Zfs 
Zip 
Artifact Analysis
Usb history viewing 
Usnjrnl 
Vinetto 
Web historian 
Audio
Aac 
Mp3 
Audio Conversion
Afconvert 
BSD
Libexif 
Bibliographies
Bibliography ascription 
Biometrics bibliography 
Disk Disposal and Data Recovery 
External links 
File carving bibliography 
Named entity recognition 
Storage class memory 
Windows memory analysis 
Bibliography
Digital forensics phd theses 
References 
Visualization bibliography 
Binary
Converting binary plists 
Executable 
Binary Analysis
Binnavi 
Ida pro 
BlackberryOS
Blackberry forensics 
Blogs
Blogs 
Books
Books About Forensics 
Cache
Chrome disk cache format 
Cell Phone Tools
Unicdma 
ChromeOS
Chrome os (cros) 
Executable 
Cloud Forensics
Cloud forensics 
Cloud forensics research 
Commercial Hardware
Azimuth radioproof enclosures 
Data copy king 
Esda 
Paraben device seizure toolbox 
Paraben stronghold bag 
Psiclone 
Commercial Software
Accessdata 
Adroit photo forensics 
Aid4mail 
Antivirus software 
Apple safari 
Aryson outlook pst repair 
Aryson pdf merge 
Bcwipe 
Belkasoft acquisition tool 
Belkasoft evidence center 
Belkasoft live ram capturer 
Bkf recovery tool 
Carbon 
Codesuite 
Cofee 
Data compass 
Datapilot secure view 
Disk explorer 
Dna 
Dtsearch 
Dxl viewer 
Edbmails exchange recovery tool 
Encase 
Forensic email collector 
Forensic explorer 
Forensic toolkit 
Forensic toolkit for sqlite 
Ftk imager 
Gargoyle investigator 
Hard drive data recovery 
Ida pro 
Ilook 
Livediscover 
Livewire investigator 
Mac marshal 
Mailpro 
Mailxaminer 
Omnipeek 
Ossec 
Oxygen forensic suite 
Oxygen pm ii 
P2pmarshal 
Paraben cell seizure 
Paraben device seizure 
Paraben sim card seizure 
ProDiscovery 
Prodiscover 
Recon for mac os x 
Recon imager 
Safe boot disk 
Safeback 
Simcon 
Sql log analyzer 
Sqlite forensic reporter 
Sqlite recovery 
Stego suite 
Symantec antivirus 
Windows media player database extractor 
Computer Bus
Ata interface 
Bus 
Firewire 
Other Information 
Usb 
Conferences
Conferences 
Digital forensic research workshop 
Vizsec 
Cryptography
Sha 2 
Data Carving
File carving 
File carving guidedcarving 
File carving smartcarving 
Fiwalk 
Foremost 
The sleuth kit 
Tsk cp 
Data Files
Internet explorer history file format 
Data Formats
Shell item 
Data Recovery
Adroit photo forensics 
Bkf recovery tool 
Bkf viewer 
Blockhashloc 
Carbon 
Data Recovery 
Data compass 
File carving 
File carving guidedcarving 
File carving smartcarving 
Hard drive data recovery 
Libcarvpath 
Linux file recovery 
Minitool data recovery 
Psiclone 
Recovering bad data 
Recovering deleted data 
Recovering overwritten data 
Scalpel 
TWRP (Team Win Recovery Project) 
Tcpxtract 
Testdisk 
The sleuth kit 
Zero storage carving 
Database
Aol pfc 
Leveldb format 
Microsoft sql server compact edition (sqlce) database files (sdf) 
Notes storage facility (nsf) 
Olm 
Personal folder file (pab, pst, ost) 
Sqlite 
Thumbs.db 
Windows 9x registry file (creg) 
Windows registry 
Database File Formats
Extensible storage engine (ese) database file (edb) format 
Sqlite database format 
Debugging
Binnavi 
Ida pro 
Deprecated
Log2timeline 
Mdd 
Pyflag 
Snarl 
Windd 
Desktop Environments
Gnome 
Desktop Search
Windows desktop search 
Digital Forensics XML
Dfxml example fileobject tag 
Dfxml example source tag 
Dfxml piecewise hashing 
Digital forensics xml bibliography 
Digital forensics xml schema 
Fileobject 
Forensic disk differencing 
Nsrl bloom xml 
Prefetch xml 
Regxml 
Disassembler
Ghidra 
Disassembly
Various methods to disassemble dex files 
Disk Analysis
Accessdata 
Autopsy forensic browser 
Autopsy forensic browser, version 2 
Bulk extractor 
Dfvfs 
Fiwalk 
Kali linux 
Knoppix 
Log2timeline 
Mac marshal 
P2pmarshal 
Plaso 
Prodiscover 
Pyflag 
Pytsk 
Sans investigative forensic toolkit workstation 
Snarl 
Snorkel 
The sleuth kit 
Tskfuse 
Virtual disk image (vdi) 
Virtual hard disk (vhd) 
Vmware from hard drive images 
Windows restore points 
Windows shadow volumes 
Disk Encryption
Bitlocker disk encryption 
Cgd 
Checkpoint full disk encryption 
Conventional File Systems 
Diskcryptor 
Filevault disk encryption 
Full disk encryption 
Full volume encryption 
Gbde 
Geli 
Imaging Options 
Libbde 
Libluksde 
Linux unified key setup (luks) 
Truecrypt 
Usbcrypt 
Vnconfig 
Windows encrypted file system 
Disk Image
Advanced Forensic Framework 4 (AFF4) 
Aff 
Dmg 
Encase image file format 
Qcow image format 
Raw image format 
Windows imaging file format (wim) 
Disk Imaging
Aimage 
Air 
Asr data's expert witness compression format 
Atola insight forensic 
Atola taskforce 
Belkasoft acquisition tool 
Carbon 
Data compass 
Data copy king 
Dd 
Deepspar 
Deepspar disk imager 
Disk imaging 
Ftk imager 
Helix3 
Helix3 pro 
Libaff4 
Libewf 
Libqcow 
Libsmdev 
Libsmraw 
Libvhdi 
Libvmdk 
Linen 
Prodiscover image file format 
Recon for mac os x 
Recon imager 
Wiebetech 
Windd 
Write blockers 
Xmount 
Download Managers
Fast thunder 
Email Analysis
Aid4mail 
Data fusion 
Edbmails exchange recovery tool 
Email analysis 
Email headers 
Eml viewer 
Eudora header format 
Evolution header format 
Fookes software 
Mailpro 
Mailxaminer 
Mbox viewer 
Ost reporter 
Pst file viewer 
Pst reporter 
Yahoo! mail header format 
Encryption
3des 
Aes 
Blowfish 
Cgd 
Checkpoint full disk encryption 
Conventional File Systems 
Des 
Diskcryptor 
Encryption 
File vault 
Filevault disk encryption 
Freeotfe 
Full volume encryption 
Gbde 
Geli 
Gnupg 
Linux unified key setup (luks) 
Rainbow tables 
Rc4 
Serpent 
Truecrypt 
Twofish 
Usbcrypt 
Vnconfig 
Vpn 
Windows encrypted file system 
End of Life
Google desktop search 
Error Mitigation
Solveit 
File Analysis
Adroit photo forensics 
Analyzemft 
Analyzing program execution 
Aryson outlook pst repair 
Binplist 
Bless 
Dstrings 
Dxl viewer 
Eml viewer 
Hachoir 
Libagdb 
Libcarvpath 
Libyal 
Pdfinfo 
Peid 
Pst file viewer 
Pst reporter 
Timestomp 
Xpdf 
File Formats
$mft 
Aac 
Advanced Forensic Framework 4 (AFF4) 
Aff 
Amcache 
Analyzing program execution 
Aol pfc 
Appledouble header file 
Arff 
Asr data's expert witness compression format 
Basic security module (bsm) file format 
Bmp 
Body File 
Bzip2 
Cabinet archive format (cab) 
Chrome disk cache format 
Common log file system (clfs) 
Converting binary plists 
Cpio 
Cue sheet format 
Digital evidence bags 
Dmg 
Email analysis 
Eml 
Encapsulated postscript (eps) 
Encase hash files 
Encase hash map 
Encase image file format 
Excel spreadsheet (xls) 
Excel spreadsheet (xlsb) 
Excel spreadsheet (xlsx) 
Executable 
Exif 
Extensible storage engine (ese) database file (edb) format 
File formats 
Firefox disk cache format 
Gfzip 
Gif 
Gpx 
Gzip 
Hiberfil.sys 
Html 
Internet explorer history file format 
Iximager file formats 
Jpeg 
Kaspersky quarantine file 
Kaspersky report file 
Leveldb format 
Linux logs analysis 
Lnk 
Mbox 
Microsoft office file formats 
Microsoft sql server compact edition (sqlce) database files (sdf) 
Mozilla firefox 3 history file format 
Mozilla firefox history file format 
Mp3 
Nickfile (nk2) 
Notes storage facility (nsf) 
Ntbackup file (bkf) 
ODL/ODLGZ Log files 
Ole compound file 
Olm 
Open document format 
Open virtualization format (ovf) 
Outlook express database (dbx) 
Pcap 
Pdf 
Personal folder file (pab, pst, ost) 
Portable executable format 
Portable network graphics (png) 
Prodiscover image file format 
Property list (plist) 
Qcow image format 
Rar 
Raw image format 
Rich text format (rtf) 
Seqbox 
Sgzip 
Spotlight database file format 
Sql log file (ldf) 
Sqlite database format 
Tar 
Text file (txt) 
The bat header format 
Thumbs.db 
Tiff 
Url 
Virtual disk image (vdi) 
Virtual hard disk (vhd) 
Vmware virtual disk format (vmdk) 
Webloc 
Windows 9x registry file (creg) 
Windows event log (evt) 
Windows imaging file format (wim) 
Windows job file format 
Windows nt registry file (regf) 
Windows prefetch file format 
Windows registry 
Windows registry xml 
Windows superfetch format 
Windows xml event log (evtx) 
Word document (doc) 
Word document (docx) 
Xml 
Xz 
Zip 
File Systems
Apple file system (apfs) 
Conventional File Systems 
Encfs 
Extended file system (ext) 
Fat 
Ffs 
Hfs+ 
Identifying file systems 
New technology file system (ntfs) 
Reiserfs 
Resilient file system (refs) 
Unix file system (ufs) 
Xfs 
Yaffs 
Zfs 
Free Software
Antivirus software 
Bkf viewer 
Ccleaner 
E01 viewer 
Eml viewer 
Kernel for outlook password recovery 
Minitool data recovery 
Ost reporter 
Ost viewer 
Paladin forensic suite live boot ubuntu 
Pst file viewer 
Pst reporter 
Sql mdf viewer 
FreeBSD
Acls 
Argus 
Bash shell 
Bcwipe 
Bzip2 
Cpio 
Data fusion 
Dd 
Executable 
Exiftool 
Ffs 
Fiwalk 
Gfzip 
Hachoir 
Ilook 
Libdnet 
Lsof 
Pcap 
Pdfinfo 
Scalpelcp 
Sgzip 
Snarl 
Snorkel 
Sqlite 
Ssdeep 
Tar 
Tcp timestamps 
Tcpxtract 
Testdisk 
Text file (txt) 
Unix file system (ufs) 
Wireshark 
Xmount 
Xpdf 
Zip 
GPL
Libpst 
Matriux 
Regimented potential incident examination report 
Xplico 
Gaming
Xbox 
Hard Drives
The Technology 
Hardware
Ata interface 
Atola insight forensic 
Atola taskforce 
Audio devices 
Bus 
Data compass 
Deepspar disk imager 
Firewire 
Ipod 
Jtag and chip off tools and equipment 
Other Information 
Pc 3000 
Physical memory 
Printers 
Serial port monitoring 
Smartphones 
The Technology 
Ufs tornado 
Usb 
Write blockers 
Xbox 
Zune 
Hashing
Context triggered piecewise hashing 
Gethashes sh 
Hashcmp 
Hashkeeper 
Imphash 
Md5 
National software reference library 
Piecewise hashing 
Sha 1 
Ssdeep 
Howtos
Acquiring a macos system with target disk mode 
Blackberry forensics 
Cell phone forensics 
Creating a VM control file from a forensic image 
Creating a windows network file share with linux 
Decrypting Android Full Disk Encryption 
Determining os version from an evidence image 
Digital signatures how to 
Forensics of virtualization products 
FreeBSD 
FreeBSD 
How to analyse partitions 
How to image an ide disk with aimage and freebsd 
How to intercept ata commands using aoe 
How to recover deleted files 
How to ship drives 
Imaging Options 
Mount shadow volumes on disk images 
Strings analysis 
TWRP (Team Win Recovery Project) 
The sleuth kit howto 
Usb history viewing 
Using message id headers to determine if an email has been forged 
Using signature headers to determine if an email has been forged 
Various methods to disassemble dex files 
Vmware from hard drive images 
Incident Response
Incident response 
Mandiant 
Regimented potential incident examination report 
Investigations
Famous cases involving digital forensics 
Knowledge Base
Solveit 
LGPL
Libesedb 
Libevt 
Libevtx 
Libexif 
Libfsntfs 
Libfvde 
Liblnk 
Libluksde 
Libmsiecf 
Libnk2 
Libnsfdb 
Libolecf 
Libpff 
Libqcow 
Libregf 
Libscca 
Libsmraw 
Libuna 
Libvhdi 
Libvmdk 
Libvshadow 
Libvslvm 
Libwrc 
Libwtcdb 
Law
Caselaw 
Famous cases involving digital forensics 
Legal issues 
Subsidiarity and proportionality 
Warrant 
Libyal
Libagdb 
Libbde 
Libdnet 
Libesedb 
Libevt 
Libevtx 
Libewf 
Libfsntfs 
Libfvde 
Liblnk 
Libluksde 
Libmsiecf 
Libnk2 
Libnsfdb 
Libolecf 
Libpff 
Libqcow 
Libregf 
Libscca 
Libsmdev 
Libsmraw 
Libuna 
Libvhdi 
Libvmdk 
Libvshadow 
Libvslvm 
Libwrc 
Libwtcdb 
Libyal 
Linux
Acls 
Affuse 
Aimage 
Air 
Alt linux rescue 
Analyzing program execution 
Apparmor 
Argus 
Autopsy forensic browser 
Autopsy forensic browser, version 2 
Backtrack 
Bash shell 
Bcwipe 
Bless 
Blockhashloc 
Body File 
Bulk extractor 
Bzip2 
Caine live cd 
Conventional File Systems 
Cpio 
Darik's boot and nuke 
Data fusion 
Dd 
Dfvfs 
Dstrings 
Early userspace 
Executable 
Exiftool 
Extended file system (ext) 
Fiwalk 
Foremost 
Gethashes sh 
Gfzip 
Gnome 
Gpart 
Grr 
Gurls 
Hachoir 
Helix3 
Helix3 pro 
Ilook 
Kali linux 
Kismet 
Libdnet 
Libewf 
Libexif 
Linux file recovery 
Linux logs analysis 
Linux unified key setup (luks) 
Linux write blocker 
Live cd 
Log2timeline 
Lsof 
Matriux 
Ntop 
Pcap 
Pdfinfo 
Plaso 
Pyflag 
Pytsk 
Recovery is possible 
Rekall 
Sans investigative forensic toolkit workstation 
Scalpel 
Scalpelcp 
Second look 
Security onion 
Selective file dumper 
Sgzip 
Snorkel 
Snort 
Sqlite 
Ssdeep 
Tar 
Tcp timestamps 
Tcpdstat 
Tcpxtract 
Testdisk 
Text file (txt) 
The sleuth kit 
Timesketch 
Truecrypt 
Tsk cp 
Ubuntu 
Vinetto 
Virtual disk image (vdi) 
Virtual hard disk (vhd) 
Volatility framework 
Wireshark 
Xmount 
Xpdf 
Xplico 
Zeitgeist 
Zip 
Live Analysis
Grr 
Live CD
Alt linux rescue 
Backtrack 
Caine live cd 
Forensic live cd issues 
Grml 
Helix3 
Helix3 pro 
Kali linux 
Knoppix 
Knoppix std 
Live cd 
Matriux 
Pentoo linux 
Recovery is possible 
Snarl 
Spada 
Winfe 
Live Forensics
Cofee 
Log Analysis
Scalpelcp 
Setup api logs 
Sql log analyzer 
Sql mdf viewer 
Sqlite forensic reporter 
Tools visualization 
Usb history viewing 
MacOS
Acls 
Acquiring a macos system with target disk mode 
Afconvert 
Affuse 
Air 
Analyzing program execution 
Apm 
Apple file system (apfs) 
Apple safari 
Appledouble header file 
Argus 
Autopsy forensic browser 
Autopsy forensic browser, version 2 
Bash shell 
Basic security module (bsm) file format 
Binplist 
Body File 
Bulk extractor 
Conventional File Systems 
Converting binary plists 
Dd 
Dfvfs 
Dmg 
Executable 
Fast thunder 
Filevault disk encryption 
Fiwalk 
Grr 
Hfs+ 
Libdnet 
Libewf 
Libexif 
Log2timeline 
Lsof 
Mac marshal 
Mac os x 
Mac os x 10.9 artifacts location 
Olm 
Paladin forensic suite live boot ubuntu 
Pcap 
Plaso 
Pyflag 
Pytsk 
Recon for mac os x 
Recon imager 
Sans investigative forensic toolkit workstation 
Scalpel 
Sgzip 
Snorkel 
Tar 
Tcc database 
Testdisk 
Text file (txt) 
The sleuth kit 
Truecrypt 
Tsk cp 
Vinetto 
Virtual disk image (vdi) 
Virtual hard disk (vhd) 
Volatility framework 
Wireshark 
Zip 
Malware
Malware 
Malware analysis 
Win32.shiz 
Memory
Physical memory 
Memory Analysis
Linux memory analysis 
Memory analysis 
Memory imaging 
Pagefile.sys 
Second look 
Tools memory analysis 
Virtualization memory analysis 
Volatility framework 
Memory Imaging
Belkasoft live ram capturer 
Mdd 
Memory imaging 
Rekall 
Tools memory imaging 
Windd 
Micro processor
Microcode 
Physical memory organization 
Mobile
Apple iphone 
Cdma 
Cell phone forensics 
Cell phones 
Chip off blackberry bold 9780 
Chip off blackberry bold 9900 
Chip off blackberry curve 9300 
Chip off blackberry curve 9315 
Chip off blackberry curve 9320 
Chip off blackberry z10 
Damaged sim card data recovery 
Global system for mobile communications 
Gprs 
Iden 
Ios 
Jtag htc wildfire s 
Jtag huawei tracfone h866c 
Jtag huawei tracfone m865c 
Jtag huawei tracfone m866c 
Jtag huawei u8655 
Jtag huawei y301 a1 valiant 
Jtag lg e960 (nexus 4) 
Jtag lg l45c tracfone 
Jtag lg p930 (nitro hd) 
Jtag nokia lumia 620 
Jtag samsung galaxy ace q (sgh i827d) 
Jtag samsung galaxy centura (sch s738c) 
Jtag samsung galaxy s3 (sgh i747m) 
Jtag samsung galaxy s4 (sgh i337) 
Microsoft pocketpc 
Microsoft windows mobile 
Paraben cell seizure 
Paraben device seizure 
Paraben device seizure toolbox 
Paraben sim card seizure 
Paraben stronghold bag 
Pdas 
Sim card forensics 
Sim cards 
Simcon 
Sms 
Mobile Devices
T mobile sidekick 
Mobile Forensics
Bitpim 
Blackberry forensics 
Datapilot secure view 
Isplumia635 
Pysim 
Mobile Operating Systems
Android 
Blackberry os 
Symbian 
Mobile device tools
Sim explorer 
Sim manager 
NetBSD
Argus 
Bash shell 
Bzip2 
Cpio 
Data fusion 
Executable 
Exiftool 
Ffs 
Gfzip 
Hachoir 
Ilook 
Libdnet 
Lsof 
Pcap 
Pdfinfo 
Scalpelcp 
Sgzip 
Snorkel 
Sqlite 
Ssdeep 
Tar 
Tcp timestamps 
Tcpxtract 
Testdisk 
Text file (txt) 
Wireshark 
Xmount 
Xpdf 
Zip 
Network Analysis
Ip geolocation 
Knoppix 
Libdnet 
Lsof 
Netstat 
Pcap 
Network Forensics
Argus 
Chaosreader 
Hidden channels 
Kali linux 
Kismac 
Kismet 
Nat detection 
Net/FSE: Network Forensic Search Engine 
Netcat 
Network Forensics Packages and Appliances 
Network forensics 
Networkminer 
Ngrep 
Nmap 
Ntop 
Os fingerprinting 
Ossec 
Proxy server 
Security onion 
Sniffer 
Snort 
Ssl forensics 
Tcp timestamps 
Tcpdstat 
Tcpdump 
Tcpflow 
Tcpxtract 
The onion router 
Vpn 
Wireless forensics 
Wireshark 
No Category
1 page report 
1x evdo 
Afentis forensics 
Aff developers guide 
Aff development task list 
Arabic pdfs 
Artifacts 
At commands 
Belkasoft r 
Belkasoft t 
Bibtex demo 
Bitflare 
Bruce allen 
Carvpath annotations 
Cellebrite ufed 
Chip off forensics 
Compression 
Computer forensics 
Computer forensics research lab 
Cortana 
Cyber threat intelligence 
Cyberspeak podcast 
Data recovery stories 
Data reduction 
Datamining for forensics 
Dc3dd 
Dccidd 
Dcfldd 
Dd rescue 
Deception indicators 
Dfl ddp data recovery equipment 
Dfl de data recovery tool 
Dfl frp hdd firmware repair tool 
Dfl srp all in one usb3.0 data recovery equipment 
Dfl srp usb3.0 for data extraction 
Dfl srp usb3.0 for samsung firmware repair 
Dfl srp usb3.0 for seagate firmware repair 
Dfl srp usb3.0 for wd firmware repair 
Dfl ure usb device data recovery equipment 
Dfwinreg 
Digital evidence 
Digital forensics lab 
Disabling macintosh disk arbitration daemon 
Edge 
Eforensics magazine 
Elcomsoft desktop forensic bundle 
Elcomsoft mobile forensic bundle 
Elcomsoft premium forensic bundle 
Error correction code 
Esn 
Event tracing for windows (etw) 
Evolution 
Extensible firmware interface 
Facebook forensics 
Fatback 
Files changed at boot windows xp 
Firmware 
First responder's evidence disk 
Footer 
Forensic 408 windows in depth 
Forensic corpora 
Forensic recovery of evidence device 
Forensics on gpus 
Frag find 
Fred 
Free and open source software 
Fseventsd 
Getting started in forensic 
Getting started in forensic research 
Global positioning system 
Gmail header format 
Gmx header format 
Groupwise 
Guymager 
Harvard forensics project 
Hashdb 
Hashdeep 
Hashutil 
Hd hpe pro 
History 
Hivexml 
Horde imp header format 
Hotmail header format 
Id3 
Imaging disks with bad sectors 
In system programming (isp) forensics 
Incredimail imm and iml 
Insider threat research 
Investigator 
Iphone mail header format 
Journals 
Jtag forensics 
Lastvisitedmru 
License transition status 
Linux presistance techniques 
Linux repositories 
Linux user accounts 
List of cyberspeak podcast interviews 
List of jump list ids 
List of mua header formats 
Live forensics 
Live view 
Locard's exchange principle 
Loci 
M3 bitlocker loader for mac 
M3 bitlocker recovery 
M3 data recovery for mac 
M3 partition recovery 
M3 raw drive recovery 
Mac times 
Makernote 
Mantis 
Mattockfs 
Mbrwizard 
Medex 
Metadata 
Microsoft exchange server 
Microsoft windows 
Mobile malware 
Mobiledit 
Most Recently Used 
Moto x play (xt1563) chip off 
Mp3stego 
Mutt header format 
Mvcom 
Nda 
Network data visualizations 
Nosql 
Nsf due 0919593 
Nuix desktop 
Ocfa treegraph api 
Ocfalib api 
Office 365 
Ontrack data eraser 
Open computer forensics architecture 
Open webmail header format 
Openssl 
Operating system password encryption 
Optimistic decompression 
Other Websites 
Outlook express header format 
Outlook header format 
Papers 
Past selected articles 
Personal digital devices 
Phone with sim card 
Pine header format 
Portable media player 
Private information in disk images 
Public domain 
Radio frequency (rf) jammers 
References 
Residual data 
Residual data on used equipment 
Rfid 
Ruim 
Safe block xp 
Scoped distribution 
Scott moulton 
Sealed digital evidence bags 
See Also 
Sender policy framework 
Setting up a flash emulator 
Solid state drive (ssd) forensics 
Spyware detection tools 
Steganalysis 
Steganography 
Sticky notes 
Stroz friedberg 
System time 
Tdma 
Techniques 
Testing and validation 
The farmer's boot cd 
Thumbnails 
Thunderbird address book mab 
Thunderbird header format 
Tool template 
Tools file analysis 
Umts 
Universally unique identifier 
Vmware virtual machine file system (vmfs) 
Windows boot configuration data 
Yaffs2 
iDEN Phonebook Manager: Overview 
Null Byte Hashes
Null Byte Hashes 
Online File Storage
Dropbox 
Google drive 
One drive 
Spideroak 
Wuala 
Open Source
Forensic server project 
Incident response collection report 
Ossec 
Open Source Software
Aff 
Affuse 
Alt linux rescue 
Antivirus software 
Apparmor 
Argus 
Autopsy forensic browser 
Autopsy forensic browser, version 2 
Backtrack 
Bash shell 
Binnavi 
Bitpim 
Bless 
Blockhashloc 
Bulk extractor 
Caine live cd 
Carvfs 
Darik's boot and nuke 
Data fusion 
Dfvfs 
Dstrings 
Eraser 
Exiftool 
Fast thunder 
File 
Foremost 
Freeotfe 
Ftimes 
Ghidra 
Gnome 
Gnupg 
Gpart 
Grr 
Hachoir 
Kismet 
Libagdb 
Libbde 
Libcarvpath 
Libdnet 
Libesedb 
Libewf 
Libexif 
Libfvde 
Liblnk 
Libwrc 
Libyal 
Linux write blocker 
Live cd 
Log2timeline 
Lsof 
Mbox viewer 
Mdd 
Miss identify 
Pdfinfo 
Peid 
Pentoo linux 
Plaso 
Pytsk 
Recyclereader 
Regimented potential incident examination report 
Regripper 
Scalpel 
Scalpelcp 
Security onion 
Slacker 
Snarl 
Snort 
Solveit 
Sqlite 
Ssdeep 
Strings 
Tcpdstat 
The sleuth kit 
Timesketch 
Truecrypt 
Tsk cp 
Tskfuse 
Usnjrnl 
Vinetto 
Volatility framework 
Windd 
Winfe 
Wireshark 
Xmount 
Xpdf 
Zeitgeist 
OpenBSD
Argus 
Bash shell 
Bcwipe 
Bzip2 
Cpio 
Data fusion 
Executable 
Exiftool 
Ffs 
Gfzip 
Hachoir 
Ilook 
Libdnet 
Lsof 
Pcap 
Pdfinfo 
Scalpelcp 
Sgzip 
Snorkel 
Sqlite 
Ssdeep 
Tar 
Tcpxtract 
Testdisk 
Text file (txt) 
Wireshark 
Xmount 
Xpdf 
Zip 
Opensource
Barnyard2 
Operating Systems
Aix 
Bsd 
Chrome os (cros) 
Freebsd 
Gpart 
Ios 
Linux 
Mac os x 
Mac os x 10.9 artifacts location 
Matriux 
Netbsd 
Openbsd 
Operating system 
Palmos 
Solaris 
Ubuntu 
Unix 
Windows 
Windows 10 
Windows 7 
Windows 8 
Windows vista 
Organization
Ace lab 
Acme portable computers 
Acquire forensics 
Air force computer emergency response team 
Air force office of special investigations 
Apple inc 
Aryson technologies 
Asr data 
Blackberry 
Cellebrite 
Cpr tools 
Defense cyber crime institute 
Defense cyber investigations training academy 
Dekart 
Department of justice computer crime and intellectual property section 
Digital assembly 
Digital intelligence 
Dod cyber crime center 
Dolphin data lab 
Elcomsoft 
Enisa 
Fbi 
Federal bureau of investigation 
Fernico 
Fookes software 
Forensic accounting 
Forensicsoft 
Guidance software 
Hoffmann investigations 
Hot pepper technology inc 
Insig2 
International Organizations 
International business machines corporation 
Kerneldatarecovery 
Logicube 
M3 data recovery 
Mandiant 
Metaspike 
Micro systemation 
Microsoft 
Napatech 
Nasa office of the inspector general 
Naval criminal investigative service 
Nokia 
Nuix pty ltd 
Ontario provincial police department 
Overview 
Oxygen software 
Palm 
Paraben forensics 
Research in motion limited 
Salvationdata 
Sans 
Sans institute 
Software Vendors 
Sony ericsson 
Sumuri llc 
Sun microsystems inc 
Swgde 
Sysinfotools software 
Systools 
Volatile systems 
Wetstone technologies inc 
Wiebetech 
X ways ag 
Organizations
Defense computer forensics lab 
Digital forensic research workshop 
Mantech 
National computer forensic institute 
National institute of standards and technology 
Papers
Cisco ios forensics 
Sanitization standards 
Sector hashing 
Timeline analysis 
People
Aaron walters 
Adrian santangelo 
Alexander geschonneck 
Amber schroader 
Andre ross 
Bradley schatz 
Bret padres 
Brian carrier 
Bruce schneier 
Cindy murphy 
David kovar 
Drew fahey 
Eric zimmerman 
George garner 
Golden g richard iii 
Harlan carvey 
James c. foster 
Jesse kornblum 
Jessica fridrich 
Jim christy 
Joachim metz 
Josh goldfoot 
Keith jones 
Ken privette 
Kevin mandia 
Kris kendall 
Kristinn gudjonsson 
Lee whitfield 
Mark russinovich 
Michael Cohen 
Michel roukine 
Nick harbour 
Nick petroni 
Ovie carroll 
Paul ohm 
Paul sanderson 
Peter gutmann 
Rob lee 
Sean peisert 
Simson l garfinkel 
Steve gibson 
The grugq 
Vincent liu 
Personal Devices
Ipod 
Smartphones 
Zune 
Photo
Portable network graphics (png) 
Tiff 
Preservation
Forensic email collector 
Overview 
Programming
Programming 
Public Domain
Sqlite 
Quality Assurance
Solveit 
Redirect
Automatic fingerprint identification system 
Big endian 
Bodyfile 
Datamining for foresnics 
Dban 
Dc3 
Dcfl 
Defense computer investigations training academy 
Defense cyber crime center 
Defense cybercrime center 
Dfrws 
Dfrws 2008 
Dfxml 
Digital corpora 
Digital forensics 
Digital forensics research workshop 
Digital forensics xml 
Digital investigative analysis 
Ewftools 
File type identification 
Forensic linux live cd issues 
Forensic training 
Forensicator 
Forensics xml 
Ftk 
Gsm 
Hiberfil 
How to setting up disk imaging station 
Ilook external imager 
Linux software write blocker 
Liveview 
Logical volume manager 
Mbr 
Microsoft office file format 
Mobile phone 
Mobile phones 
Nickfile format 
Nist 
Ntfs 
Nuix 
Open research topics 
Oxygen Forensic Suite 2 
Oxygen Forensic Suite 2014 
Paraben's device seizure 
Paraben's sim card seizure 
Personal folder file format 
Personal folder file format (pab, pst, ost) 
Property list 
Ram 
Real cases 
Rim blackberry 
Sanitizing tools 
Sha 256 
Sha 512 
Sha1deep 
Sha256 
Sim 
Sim filesystem 
Sim forensics 
Simcon help 
Similarity functions 
Simson garfinkel 
Simson's open research topics 
Solid state drives 
Source dfxml example 
Timeline analysis bibliography 
Tools timeline analysis 
Vista thumbcache 
Windows nt 
Registry Analysis
List of windows mru locations 
Opensavemru 
Regripper 
Windows registry 
Research
Academic forensics programs graduate level 
Advanced steganography demystifying steganography investigation 
Blackhat (conference) 
Blogs 
Books About Forensics 
Carver 2.0 planning page 
Cell phone forensics research 
Cisco ios forensics 
Cloud forensics research 
Conferences 
Disk reliability 
Educational resources for teaching computer forensics 
Imager ng ideas 
Leet '08 
Online resources 
Research topics 
Sanitization standards 
Sector hashing 
Timeline analysis 
Upcomingevents 
Upsec 08 
Zombies and botnets setup investigate shutdown 
Reversing
Ghidra 
Various methods to disassemble dex files 
SIM
Damaged sim card data recovery 
Sim cards 
Secure Deletion
Bcwipe 
Ccleaner 
Darik's boot and nuke 
Eraser 
Media sanitizing 
Sanitization standards 
Window washer 
Wipe 
Security Software
Antivirus software 
Apparmor 
Software
Ivpn 
Software Vendors
Arsenal recon 
Belkasoft 
Minitool solution ltd 
Solaris
Bash shell 
Basic security module (bsm) file format 
Bcwipe 
Bzip2 
Cpio 
Executable 
Ffs 
Ilook 
Tcp timestamps 
Testdisk 
Unix file system (ufs) 
Wireshark 
Zip 
System Analysis
Helix3 
Helix3 pro 
Lsof 
Miss identify 
Paladin forensic suite live boot ubuntu 
Regimented potential incident examination report 
System Monitoring
Symantec antivirus 
Text
Body File 
Cue sheet format 
Encase hash map 
Html 
Mbox 
Rich text format (rtf) 
Text file (txt) 
Url 
Windows job file format 
Threat Intelligence
Mandiant 
Timeline Analysis
Body File 
L2t csv 
Log2timeline 
Mactime 
Plaso 
Timesketch 
Tln 
Tools
Accessdata 
Adroit photo forensics 
Afconvert 
Affuse 
Aid4mail 
Aimage 
Air 
Alt linux rescue 
Analyzemft 
Antivirus software 
Apparmor 
Apple safari 
Argus 
Aryson outlook pst repair 
Aryson pdf merge 
Autopsy forensic browser 
Autopsy forensic browser, version 2 
Backtrack 
Barnyard2 
Bash shell 
Bcwipe 
Belkasoft acquisition tool 
Belkasoft evidence center 
Belkasoft live ram capturer 
Binnavi 
Binplist 
Bitcurator 
Bitpim 
Bkf recovery tool 
Bkf viewer 
Blackberry forensics 
Bless 
Blockhashloc 
Bulk extractor 
Bulk extractor viewer 
Caine live cd 
Carbon 
Carvfs 
Ccleaner 
Checkpoint full disk encryption 
Cofee 
Converting binary plists 
Darik's boot and nuke 
Data Recovery 
Data compass 
Data copy king 
Data fusion 
Data mining 
Dd 
Ddrescue 
Deepsound 
Deepspar disk imager 
Disk explorer 
Document metadata extraction 
Dstrings 
Early userspace 
Edbmails exchange recovery tool 
Eraser 
Exiftool 
Fast thunder 
File 
File format identification 
Fiwalk 
Foremost 
Forensic email collector 
Forensic server project 
Ftk imager 
Ghidra 
Gnome 
Google desktop search 
Grr 
Gurls 
Hachoir 
Hard drive data recovery 
Helix3 
Helix3 pro 
Ida pro 
Ilook 
Incident response collection report 
Iximager 
Kali linux 
Kernel for outlook password recovery 
Kismet 
Knoppix 
Libagdb 
Libbde 
Libcarvpath 
Libdnet 
Libesedb 
Libevt 
Libevtx 
Libewf 
Libexif 
Libfsntfs 
Libfvde 
Liblnk 
Libluksde 
Libmsiecf 
Libnk2 
Libnsfdb 
Libolecf 
Libpff 
Libpst 
Libqcow 
Libregf 
Libscca 
Libsmdev 
Libsmraw 
Libuna 
Libvhdi 
Libvmdk 
Libvshadow 
Libvslvm 
Libwrc 
Libwtcdb 
Libyal 
Linux file recovery 
Live cd 
Log2timeline 
Lsof 
Mac marshal 
Mailpro 
Mailxaminer 
Matriux 
Mbox viewer 
Md5deep 
Md5sum 
Mdd 
Mhdd 
Minitool data recovery 
Miss identify 
Netcat 
Netstat 
Network Forensics Packages and Appliances 
Ntop 
Ost reporter 
Ost viewer 
P2pmarshal 
Paladin forensic suite live boot ubuntu 
Pdfinfo 
Peid 
Pentoo linux 
Plaso 
Prodiscover 
Psiclone 
Pst file viewer 
Pst reporter 
Pyflag 
Pytsk 
Recon for mac os x 
Recon imager 
Recovery is possible 
Recyclereader 
Regimented potential incident examination report 
Registryasxml 
Regripper 
Sans investigative forensic toolkit workstation 
Scalpel 
Scalpelcp 
Second look 
Security onion 
Simis 
Slacker 
Snarl 
Snorkel 
Snort 
Solveit 
Sql database recovery tool 
Sql log analyzer 
Sql mdf viewer 
Sqlite 
Sqlite forensic reporter 
Ssdeep 
Strings 
Strings analysis 
Symantec antivirus 
TWRP (Team Win Recovery Project) 
Tcp timestamps 
Tcpdstat 
Tcpxtract 
Testdisk 
The sleuth kit 
Timeline analysis 
Timesketch 
Tools 
Tools memory analysis 
Tools memory imaging 
Tools visualization 
Tsk cp 
Tskfuse 
Unique 
Usbcrypt 
Usnjrnl 
Vinetto 
Vmware 
Volatility framework 
Web historian 
Windd 
Winfe 
Xmount 
Xpdf 
Xplico 
Training
Advanced steganography demystifying steganography investigation 
Hacking bootcamp exploits and live incident investigation 
Introduction to steganography 
Leet '08 
Sans 
The art of keylogging 
Training courses and providers 
Zombies and botnets setup investigate shutdown 
Vendors
Komoku 
Virtual Disk
Virtual disk image (vdi) 
Virtual hard disk (vhd) 
Vmware from hard drive images 
Volume Systems
Gpt 
Linux logical volume manager (lvm) 
Logical disk manager (ldm) 
Master boot record 
Web Browsers
Apple safari 
Google chrome 
Internet explorer 
Konqueror 
Mozilla firefox 
Opera 
Websites
Cell phone forensics research 
Cloud forensics research 
Websites 
Windows
$mft 
Accessdata 
Acls 
Active directory 
Adroit photo forensics 
Air 
Amcache 
Analyzemft 
Analyzing program execution 
Aol pfc 
Apple safari 
Argus 
Aryson outlook pst repair 
Aryson pdf merge 
Autopsy forensic browser 
Autopsy forensic browser, version 2 
Bcwipe 
Belkasoft acquisition tool 
Belkasoft evidence center 
Belkasoft live ram capturer 
Bitlocker disk encryption 
Bkf recovery tool 
Bkf viewer 
Body File 
Bulk extractor 
Cabinet archive format (cab) 
Carbon 
Ccleaner 
Checkpoint full disk encryption 
Cofee 
Common log file system (clfs) 
Conventional File Systems 
Data fusion 
Dd 
Dfvfs 
Disk explorer 
E01 viewer 
Eml 
Eml viewer 
Encase hash map 
Eraser 
Executable 
Exiftool 
Fast thunder 
Fat 
Fiwalk 
Forensic email collector 
Ftk imager 
Grr 
Hachoir 
Hard drive data recovery 
Ilook 
Imaging Options 
Internet explorer history file format 
Jump lists 
Kernel for outlook password recovery 
Libagdb 
Libdnet 
Libewf 
Libexif 
List of windows mru locations 
Lnk 
Log2timeline 
Mailpro 
Mailxaminer 
Mbox viewer 
Mdd 
Microsoft mail header format 
Microsoft pocketpc 
Microsoft sql server compact edition (sqlce) database files (sdf) 
Microsoft windows mobile 
Minitool data recovery 
Miss identify 
Notes storage facility (nsf) 
Ntop 
Opensavemru 
Opensavepidlmru 
Ost reporter 
Ost viewer 
P2pmarshal 
Pcap 
Pdfinfo 
Peid 
Personal folder file (pab, pst, ost) 
Plaso 
Prefetch 
Prodiscover 
Prodiscover image file format 
Psiclone 
Pst file viewer 
Pst reporter 
Pyflag 
Pytsk 
Readyboot 
Recyclereader 
Regimented potential incident examination report 
Regripper 
Rich text format (rtf) 
Sans investigative forensic toolkit workstation 
Scalpel 
Scalpelcp 
Sccm 
Setup api logs 
Sgzip 
Slacker 
Snorkel 
Sql log analyzer 
Sql mdf viewer 
Sqlite 
Sqlite forensic reporter 
Ssdeep 
Superfetch 
Symantec antivirus 
Tar 
Tcp timestamps 
Testdisk 
Text file (txt) 
The sleuth kit 
Thumbs.db 
Truecrypt 
Tsk cp 
Unique 
Url 
Usb history viewing 
Usbcrypt 
User account control (uac) 
Usnjrnl 
Vinetto 
Virtual disk image (vdi) 
Virtual hard disk (vhd) 
Volatility framework 
Web historian 
Windd 
Window washer 
Windows 9x registry file (creg) 
Windows application compatibility 
Windows encrypted file system 
Windows event log (evt) 
Windows file history 
Windows imaging file format (wim) 
Windows job file format 
Windows prefetch file format 
Windows registry 
Windows registry xml 
Windows restore points 
Windows shadow volumes 
Windows storage spaces 
Windows thumbcache 
Windows vista 
Windows xml event log (evtx) 
Winfe 
Wireshark 
Wmi 
Xpdf 
Zip 
Windows Mobile
Oxygen forensic suite 
Oxygen pm ii 
Wireless
Kismet 
Write Blocker
Carbon 
XML
Fiwalk 
Windows registry xml 
Windows xml event log (evtx) 
Xml 
iOS
Apple safari 
Fast thunder 
Sqlite