Digital Forensics Tools: What a SOC Analyst Opens First

The digital forensics tools a SOC analyst opens first are the ones that save what disappears first: a memory capture tool and Volatility 3 for RAM, KAPE to pull the key Windows artifacts in minutes, and Hayabusa or Chainsaw to turn the event logs into a timeline. Full disk images (FTK Imager, Autopsy, plaso) usually come after the host is contained.

The top results for this search list commercial suites. In a SOC, a tier 2 analyst usually gets a host, an hour, and a question such as "did this run, and what did it touch?". This guide is ordered around that hour. Every version, license and command below was checked against the project's own repository or documentation on November 2, 2026.

How we picked and checked these tools

A tool made the list if a tier 1 or tier 2 analyst would plausibly use it on an incident in their own environment, and if it covers a source of evidence the others do not. We checked four things for each one on November 2, 2026:

1. Version and maintenance. Latest release on the GitHub releases page or the vendor's download page.
2. License and price. From the repository license, the project FAQ or the vendor's order page. If a vendor does not publish a price, we say so.
3. The command. Every command and plugin name below comes from the project's README, man page or official docs, not from a blog post. That is how we caught the two renamed commands mentioned above.
4. When not to use it. Each entry says who should skip it.

Velociraptor is the one big free DFIR tool not covered in detail here. It collects artifacts and answers queries across a whole fleet of endpoints, which makes it a hunting platform as much as a forensic one; the threat hunting tools guide walks through it with a working VQL query. Version 0.77.3 is current (releases).

Digital forensics tools at a glance

The first hour: what to open, in order

The order comes from RFC 3227, the evidence collection guideline most DFIR procedures still cite: collect "from the volatile to the less volatile". The incident response plan template lists the full RFC order and turns it into a procedure, so here is only what it means for tools:

1. Contain without powering off. RFC 3227 says "Don't shutdown until you've completed evidence collection", and warns that pulling the network cable can trigger "deadman switches" that wipe evidence. Network isolation through your EDR keeps the host running and reachable.
2. Capture memory. FTK Imager has a RAM capture feature; your EDR may also offer one. Write the image to external or network storage, not the suspect disk.
3. Collect triage artifacts. KAPE copies event logs, registry hives, Prefetch, Amcache, the $MFT and browser history in minutes, including locked files.
4. Start analysis while the disk images. Run Volatility 3 on the memory image and Hayabusa on the event logs. Most first-hour answers come from these two.
5. Image the disk if the case needs it. FTK Imager behind a write blocker for a removed drive, then Autopsy or plaso on the image.

Record every step for the chain of custody. RFC 3227 lists what to document: where, when and by whom evidence was found, collected, handled and examined, and who held it during which period. Hash every image when you create it and again before analysis.

Artifact, tool, command: the lookup table

Start from what you have in hand. Each row gives the tool that reads it and the first command to run; paths are examples.

KAPE: triage collection in minutes

KAPE (Kroll Artifact Parser and Extractor) does two jobs, according to its documentation: collect files from a source using Targets, then optionally run programs over them using Modules. A Target is a list of file and directory specifications; KapeTriage is the compound one most people start with, and its own description says it pulls file system files, registry hives, event logs, scheduled tasks, evidence of execution, SRUM, browser history, LNK files and jump lists, among others (KapeTriage.tkape). The !SANS_Triage Target is the other common choice.

Two details make KAPE fit for evidence work, both from Eric Zimmerman's introduction to the tool. Files locked by the operating system get a second pass that bypasses the lock. And KAPE preserves metadata about every file it copies into the destination.

# Collect triage artifacts into a VHDX, then parse them with the EZ Tools module set
.\kape.exe --tsource C: --tdest E:\%m\tout --target KapeTriage --vhdx %m
.\kape.exe --msource E:\%m\tout --mdest E:\%m\mout --module !EZParser

%m expands to the machine name and %d to a timestamp, per the switch reference. Container switches such as --vhdx need a base name after them, or KAPE ignores the switch and creates no container. Module binaries are not downloaded for you; the FAQ says that is deliberate.

Licensing changed this year. The KAPE FAQ says KAPE is free for government agencies and for "educational, research, and internal company use", and that "As of January 1, 2026 KAPE IS NO LONGER AVAILABLE for commercial use (i.e. when used on a third-party network and/or as part of a paid engagement)."

Skip it if you work for an MSSP or consultancy and the host belongs to a client. Velociraptor or your EDR's collection feature can cover the same artifacts.

Volatility 3: what was running

Memory is where you find what the disk does not keep: processes that never wrote a file, network connections already closed in the logs, and code injected into a legitimate process. Volatility 3 is the standard free framework for reading it. Version 2.28.2 was released on September 17, 2026, it needs Python 3.8 or later, and it installs with pip install volatility3. The Volatility 2 repository is archived on GitHub, so tutorials that start with --profile=Win7SP1x64 are for the old tool. Volatility 3 no longer uses profiles: Windows symbol tables are downloaded and cached on first use, while Linux and macOS images need tables built with dwarf2json.

A first pass on a Windows memory image:

vol -f mem.raw windows.info                 # confirm the image parses
vol -f mem.raw windows.pstree               # process tree
vol -f mem.raw windows.cmdline              # full command lines
vol -f mem.raw windows.netscan              # TCP/UDP endpoints and listeners
vol -f mem.raw windows.malware.malfind      # suspicious memory regions
vol -f mem.raw -r csv windows.pslist > pslist.csv

-r (--renderer) changes the output format and -o (--output-dir) sets where dumped files go. windows.netscan returns Offset, Proto, LocalAddr, LocalPort, ForeignAddr, ForeignPort, State, PID, Owner and Created, so you can tie a remote IP to a process without the SIEM.

The renamed plugin. In the stable branch, windows.malfind is now a deprecation shim pointing to windows.malware.malfind, with a removal_date of 2026-06-07 in its source. That date has passed. If a script that worked last year now fails on malfind, change the plugin name.

Skip it if you have no memory image. Volatility cannot help after a reboot, which is the strongest argument for capturing RAM before anything else.

FTK Imager: acquire the evidence

FTK Imager is Exterro's free acquisition tool. Its product page lists disk imaging, RAM capture, previewing drives and images before you image them, image mounting, and hash report generation; the page's structured data gives the price as 0 and the operating system as Windows. The full FTK suite is a separate, paid product.

In a SOC it does two jobs: capturing RAM on a live Windows host when your EDR cannot, and imaging a removed drive. For a removed drive, put a write blocker between the disk and your workstation. NIST tests both hardware and software write blockers in its Computer Forensics Tool Testing program, which is the place to check a model before you trust it. Then compare the hash FTK Imager reports for the source with the hash of the image before you start working.

Skip it if you are on Linux or macOS; it installs on Windows only.

Autopsy and The Sleuth Kit: inside the disk image

The Sleuth Kit is a set of command line tools that read file systems directly from an image, deleted entries included. Autopsy is the graphical front end on top of it, with indexed keyword search, hash filtering of known good and known bad files, browser history and cookies, data carving and a timeline view. Autopsy 4.23.1 (May 7, 2026) and Sleuth Kit 4.15.0 (April 15, 2026) are the current releases; Autopsy's source is Apache 2 and its site says simply "Autopsy is free."

For a fast file system timeline without opening a GUI, the two-step from the fls and mactime man pages still works:

fls -r -m C: image.dd > body.txt      # recursive listing in body file format, paths prefixed with C:
mactime -b body.txt -d > fs.csv       # sort into a comma-delimited timeline

Skip it if the question is only "what ran on this host in the last day". KAPE plus the EZ Tools answers that faster than processing a full image.

plaso: one timeline from everything

plaso (the engine behind log2timeline.py) walks a whole image and extracts every timestamp it has a parser for: file system, event logs, registry, browser history, and more. The latest release is 20261027, under Apache 2.0. The pattern from the log2timeline and psort docs:

log2timeline.py --storage-file timeline.plaso /cases/host01/image.E01
psort.py -o dynamic -w timeline.csv timeline.plaso
psort.py -q --slice "2026-10-30T14:02:11" timeline.plaso

In the third line, --slice returns only events around a timestamp of interest, five minutes either side by default (--slice_size changes it), and since 20200613 the time must be in ISO 8601 format.

Skip it if you are in the first hour. A full plaso run over a large disk is slow, and the output is big enough that you need a viewer such as Timesketch to work through it.

Event logs and registry: EZ Tools, RegRipper, Hayabusa, Chainsaw

These are the tools a SOC analyst uses most, because event logs and registry hives are what KAPE hands you.

Eric Zimmerman's tools. A set of free Windows parsers, each for one artifact: EvtxECmd for event logs, MFTECmd for $MFT and the USN journal, PECmd for Prefetch, AmcacheParser, RECmd and Registry Explorer for the registry, and Timeline Explorer to filter the CSVs they produce. The tools page lists versions in the 2026.10 series and recommends the .NET 10 builds; the Get-ZimmermanTools script downloads and updates all of them.

RegRipper 4.0. Runs plugins against a registry hive and prints the findings, now with MITRE ATT&CK mapping for some plugins. Two warnings from its README: the license is "free for personal and academic (college/university) use ONLY", and it "does NOT automatically process hive transaction logs." Run rip.exe -r SYSTEM -d to check whether the hive is dirty, and if it is, replay the logs with Eric Zimmerman's rla.exe before you trust the output. RECmd and Registry Explorer are the alternatives if the license rules out RegRipper at work.

Hayabusa. A Rust tool that runs Sigma and its own rules over EVTX files and writes one timeline. Version 4.3.1 was released on October 29, 2026, under AGPL-3.0.

hayabusa.exe dfir-timeline -d E:\tout\C\Windows\System32\winevt\Logs -o timeline.csv -w
hayabusa.exe logon-summary -d E:\Logs -o logon-summary.csv

-w skips the interactive scan wizard, which is on by default. If you learned Hayabusa from a 2025 tutorial, note the 4.0.0 changelog (July 29, 2026): csv-timeline and json-timeline were combined into dfir-timeline, with the format chosen by -t csv|json|jsonl. The -t short flag used to mean --threads, so an old -t 4 now means something else.

Chainsaw. Built by WithSecure for the same job, with a different strength: fast keyword and field search across EVTX files on top of Sigma hunting. Version 2.17.1, GPL-3.0. From the README:

chainsaw hunt E:/Logs -s sigma/ --mapping mappings/sigma-event-logs-all.yml --from "2026-10-30T13:00:00" --to "2026-10-30T15:00:00"
chainsaw search -t 'Event.System.EventID: =4104' E:/Logs

Run both if you have time: Hayabusa's timeline is easier to read end to end, Chainsaw's search is quicker for "show me every 4104 with this string". If the event IDs in the output are unfamiliar, the Windows event IDs cheat sheet and the Sysmon event IDs guide cover the ones that matter, and how to read Windows event logs covers where the files live.

Network evidence: Wireshark and Zeek

If the incident involves a PCAP (from a sensor, a firewall export or a capture you started during containment), use Zeek for the overview and Wireshark for the detail.

Zeek 9.0.1 reads a PCAP and writes structured logs: conn.log for every connection, plus dns.log, http.log, ssl.log and others when it recognizes the protocol. Each connection gets a uid, and the quickstart's advice is to pivot on it: find the suspicious connection in conn.log, then search the same uid in http.log.

zeek -r capture.pcap LogAscii::use_json=T

Wireshark 4.6.9 is where you confirm what Zeek summarized, one packet at a time. Display filter fields such as tls.handshake.extensions_server_name, http.host and http.request.method come from its field reference.

Skip both if you have no packets. If your SOC keeps only flow or firewall logs, the work happens in SIEM queries instead.

A first hour, end to end

The notes below follow one host from alert to finding. The host, user, file names and addresses are invented; the commands are the ones from this guide.

# Simulated example generated by SOCSimulator Research
14:05  ALERT   EDR: schtasks.exe created task "OneDriveSync" on FIN-WS07, user m.ruiz
14:08  CONTAIN EDR network isolation (host stays powered on, EDR channel open)
14:11  MEMORY  RAM captured to \\evidence\FIN-WS07\mem.raw, SHA-256 recorded in case log
14:19  TRIAGE  kape.exe --tsource C: --tdest \\evidence\%m\tout --target KapeTriage --vhdx %m
14:31  MEMORY  vol -f mem.raw windows.pstree
               PID 5120  PPID 3888  powershell.exe  -w hidden -enc SQBFAFgA...
               PPID 3888 = WINWORD.EXE
14:34  MEMORY  vol -f mem.raw windows.netscan
               TCPv4 10.20.7.41:51544 -> 203.0.113.80:443 ESTABLISHED PID 5120 powershell.exe
14:40  EVTX    hayabusa.exe dfir-timeline -d ...\winevt\Logs -o timeline.csv -w
               14:02:58 Security 4698 task created \OneDriveSync, author FIN\m.ruiz
               14:02:57 PowerShell 4104 script block with IEX and a download from 203.0.113.80
14:52  FINDING Word spawned PowerShell, which created a scheduled task for persistence
               and holds a live session to 203.0.113.80. Escalate, block the IP,
               hunt for the task name and IP on other hosts.

Nothing in that hour needed a full disk image. The memory image tied the network connection to a process and its parent, which the event logs alone could not show, and the timeline dated the persistence to one minute after the macro ran. The disk image comes next, for the questions that take longer: what else was dropped, and whether anything was deleted.

Free tools vs commercial suites

The free tools above cover most SOC investigations. Commercial suites put the same steps in one case file, add support and court-tested reporting, and handle sources the free tools cover poorly, such as phones and cloud accounts.

EnCase is now sold as OpenText Forensic, so job ads and documentation use both names. If you are learning, the free tools teach the artifacts themselves, and that knowledge carries over to any suite.

Mistakes that cost evidence

1. Powering off to preserve the host. It preserves the disk and destroys the memory. Isolate through the EDR instead.
2. Writing output to the suspect disk. Every file you create on C: can overwrite deleted data you needed. Send captures and KAPE output to external or network storage.
3. Trusting a dirty registry hive. RegRipper reads the hive as it is on disk; recent changes may still be in the transaction logs. Check with -d and replay with rla.exe.
4. Following an old tutorial line by line. --profile (Volatility 2), windows.malfind and hayabusa csv-timeline all appear in guides that still rank, and all three have changed.
5. Not hashing at acquisition. A hash taken a day later proves nothing about the day before. Hash when you create the image and record it in the case log.
6. Assuming a free license covers your job. KAPE excludes paid engagements; RegRipper 4.0 is limited to personal and academic use. Check before you run them on client or employer systems.

Where to practise these skills

The artifacts behind these tools are the same ones that show up as alerts first: a scheduled task created by an Office process, a PowerShell script block, an outbound connection from a process that should not have one. The digital forensics glossary entry covers the discipline and its vocabulary, and the DFIR analyst career path shows where the work leads.

To build the habit of reading those signals under time pressure, the malicious scheduled task persistence operation in SOCSimulator puts you on a live SIEM, XDR and Firewall console with a persistence case like the one above. The free SOC analyst training page lists what the free tier includes.