Volatility alternatives

Looking for an alternative tool to replace Volatility? During the review of Volatility we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

  1. MIG (real-time investigation tool)
  2. dfis (DFIR toolkit)
  3. GRR Rapid Response (remote live forensics for incident response)

These tools are ranked as the best alternatives to Volatility.

Alternatives (by score)

74

MIG (Mozilla InvestiGator)

Introduction

MIG provides a platform to perform investigative analysis on remote systems. By using the right queries, information can be obtained from these systems. This all happens in parallel, making intrusion detection, investigation, and follow-up easier.

Project details

Strengths and weaknesses

  • + More than 25 contributors
  • + More than 1000 GitHub stars
  • + The source code of this software is available
  • + Supported by a large company

    Typical usage

    • Digital forensics
    • Intrusion detection

    MIG review

    64

    dfis (Digital Forensic Investigative Scripts)

    Introduction

    This toolkit of scripts are made by Hal to help in forensic assignments. They make several parts of the job easier, like converting data to another format for further processing.

    Project details

    dfis is written in Perl.

    Strengths and weaknesses

    • + The source code of this software is available
    • + Well-known author
    • - No updates for a while

    Typical usage

    • Digital forensics

    dfis review

    100

    GRR Rapid Response

    Introduction

    The goal of the GRR tooling is to support digital forensics and investigations. By using a fast and scalable model, analysts can quickly perform their analysis. One of the main features is the ability to search for particular information or details. This process is called hunting.

    Project details

    GRR Rapid Response is written in Python.

    Strengths and weaknesses

    • + More than 25 contributors
    • + More than 3000 GitHub stars
    • + The source code of this software is available
    • + Supported by a large company

      Typical usage

      • Digital forensics
      • Intrusion detection
      • Threat hunting

      GRR Rapid Response review

      97

      The Sleuth Kit

      Introduction

      The Sleuth Kit is a forensics tool to analyze volume and file system data on disk images. With its modular design, it can be used to carve out the right data, find evidence, and use it for digital forensics.

      Project details

      The Sleuth Kit is written in C.

      Strengths and weaknesses

      • + More than 50 contributors
      • + More than 1000 GitHub stars
      • + The source code of this software is available
      • + Well-known tool

        Typical usage

        • Criminal investigations
        • Digital forensics
        • File system analysis

        The Sleuth Kit review

        88

        r2frida

        Introduction

        Both Radare2 and Frida have their own area of expertise. This project combines both, to allow a more extensive analysis of files and processes.

        Project details

        r2frida is written in C, JavaScript.

        Strengths and weaknesses

        • + The source code of this software is available

          Typical usage

          • Application testing
          • Binary analysis
          • Memory analysis

          r2frida review

          64

          Bitscout

          Introduction

          Bitscout contains a set of popular tools to acquire and analyze disk images onsite. It saves engineers from traveling to the physical location. In other words, it is providing the option to do remote forensics. The project claims that everything is correctly implemented when it comes to digital forensics. One of these requirements is that no data is altered. For example, the remote security professional can obtain a disk image clone, but not alter the machine state.

          Project details

          Bitscout is written in shell script.

          Strengths and weaknesses

          • + Used language is shell script
          • + The source code of this software is available

            Typical usage

            • Digital forensics

            Bitscout review

            60

            libewf

            Introduction

            The libewf toolkit is useful for those who need to create a disk image or perform disk forensics.

            Project details

            libewf is written in C.

            Strengths and weaknesses

            • + The source code of this software is available

              Typical usage

              • Digital forensics

              libewf review

              100

              radare2

              Introduction

              Radare2 is a popular framework to perform reverse engineering on many different file types. It can be used to analyze malware, firmware, or any other type of binary files. Besides reverse engineering, it can be used for forensics on filesystems and do data carving. Tasks can be scripted and support languages like JavaScript, Go, and Python. Even software exploitation is one of the functions it can be used in.

              Project details

              radare2 is written in C.

              Strengths and weaknesses

              • + More than 500 contributors
              • + More than 8000 GitHub stars
              • + Many releases available
              • + The source code of this software is available

                Typical usage

                • Digital forensics
                • Reverse engineering
                • Software exploitation
                • Troubleshooting

                radare2 review

                60

                shellbags

                Introduction

                Typically this tool will be used to gather information from a compromised system or to track traces from a system to find evidence. Shellbags can provide some insight on browsed directories on the system via Explorer on Microsoft Windows systems.

                Project details

                shellbags is written in Python.

                Strengths and weaknesses

                • + The source code of this software is available

                  Typical usage

                  • Digital forensics

                  shellbags review

                  64

                  FIR (Fast Incident Response)

                  Introduction

                  FIR is an incident response tool written in the Django framework. It provides a web interface to deal with the creation and management of security-related incidents.

                  Project details

                  Strengths and weaknesses

                  • + More than 10 contributors
                  • + The source code of this software is available

                    Typical usage

                    • Incident response
                    • Security monitoring

                    FIR review

                    85

                    LogonTracer

                    Introduction

                    LogonTracer is a tool to investigate malicious logins from Windows event logs with visualization capabilities.

                    Project details

                    LogonTracer is written in Python.

                    Strengths and weaknesses

                    • + More than 500 contributors
                    • + The source code of this software is available

                      Typical usage

                      • Criminal investigations
                      • Digital forensics
                      • Learning

                      LogonTracer review

                      93

                      Loki

                      Introduction

                      Loki is security tool to find so-called indicators of compromise (IOC). It does this by scanning files and then uses pattern matching.

                      Project details

                      Loki is written in Python.

                      Strengths and weaknesses

                      • + More than 10 contributors
                      • + Commercial support available
                      • + More than 500 GitHub stars
                      • + The source code of this software is available

                        Typical usage

                        • Digital forensics
                        • Intrusion detection
                        • Security monitoring

                        Loki review

                        100

                        TheHive

                        Introduction

                        TheHive is scalable and a complete platform to deal with security incidents. It allows for collaboration between those responsible for dealing with such incidents and related events. It can even use the data of the MISP project, making it easier to start analyzing from there.

                        Project details

                        TheHive is written in Scala.

                        Strengths and weaknesses

                        • + More than 10 contributors
                        • + More than 500 GitHub stars
                        • + The source code of this software is available

                          Typical usage

                          • Digital forensics
                          • Incident response
                          • Intrusion detection

                          TheHive review

                          60

                          ThreatPinch Lookup

                          Introduction

                          ThreatPinch helps to speed up collecting information from common resources like CVE databases or public WHOIS data. As it works from the browser, it is a helpful addition for people who have to perform forensics, security monitoring, or system administration. For example, getting the owner of a domain and IP address becomes almost instant knowledge.

                          Project details

                          ThreatPinch Lookup is written in JavaScript.

                          Strengths and weaknesses

                          • + Many integration possibilities available
                          • - Unknown project license

                          Typical usage

                          • Information gathering
                          • Threat hunting

                          ThreatPinch Lookup review

                          56

                          AESKeyFinder

                          Introduction

                          AESKeyFinder uses various algorithms to perform entropy tests and filter out blocks that are not AES keys. The remaining blocks are then displayed as possible AES keys.

                          Project details

                          Strengths and weaknesses

                          • + The source code of this software is available
                          • - No proper description on website
                          • - No updates for a while

                          Typical usage

                          • Data extraction

                          AESKeyFinder review

                          Some relevant tool missing as an alternative to Volatility? Please contact us with your suggestion.