_ ReconLab
Commands  /  Forensics

Forensics

Carving, memory & disk analysis, steganography and metadata. · 19 commands

Binwalk

passive
Analyse & extract embedded files from firmware.
KaliParrotLinux

Foremost

passive
Recover files by header/footer carving.
KaliParrotLinux

Volatility

passive
Memory (RAM) forensics framework.
KaliParrotLinux

ExifTool

passive
Read/write file metadata (EXIF and beyond).
KaliParrotLinux

Steghide

passive
Hide/extract data inside images and audio.
KaliParrotLinux

Autopsy

passive
GUI digital-forensics platform (Sleuth Kit).
KaliParrotLinux

dd

medium
Low-level block copy / disk imaging.
KaliParrotLinux

The Sleuth Kit

passive
CLI toolkit for disk & filesystem forensics.
KaliParrotLinux

TestDisk

medium
Recover lost partitions & fix disks.
KaliParrotLinux

PhotoRec

passive
Carve files regardless of filesystem.
KaliParrotLinux

bulk_extractor

passive
Scan images for emails, cards, URLs.
KaliParrotLinux

chkrootkit

passive
Check a system for known rootkits.
KaliParrotLinux

rkhunter

passive
Rootkit Hunter integrity checker.
KaliParrotLinux

Stegseek

passive
Ultra-fast steghide passphrase cracker.
KaliParrot

zsteg

passive
Detect LSB steganography in PNG/BMP.
KaliParrot

GNU ddrescue

medium
Image failing disks with error recovery.
KaliParrotLinux

Scalpel

passive
Fast, configurable file carver.
KaliParrotLinux

pdf-parser

passive
Inspect PDF structure & embedded objects.
KaliParrot

hashdeep

passive
Recursively hash & audit file sets.
KaliParrotLinux