The standards, books, journals, tools, datasets and training a digital forensics practitioner — or the lawyer questioning one — actually needs, with the limits of each stated plainly.
This library annotates the 180 sources digital forensics actually runs on: standards, books, journals, tools, datasets, conferences and training. Each entry says what the item is, who should read it, and — the part most lists leave out — what it does not cover. Standard numbers, editions and identifiers appear only where they were read off the publisher’s own page, and every entry records the date it was checked.
A list this long is not a curriculum. These two sequences are, and each one says why every step is where it is.
You have no forensics background and want the shape of the whole field before you specialise.
This is the order that gets you from nothing to genuinely useful without wasting money. It goes breadth first, then the rules you will be held to, then one mechanism deep enough to defend, then a tool, then real practice data. Reckon on three to six months of evenings if you are working full time; the first three steps are free and take a fortnight.
You are a litigator facing a digital forensics expert and you need to know where the soft ground is.
You are not trying to become an examiner. You are trying to know, precisely, what a competent one should have done, what the record should show, and which of their conclusions the science will not carry. Two focused days gets you through the free material; the paid items matter only if the case turns on method.
All reading paths — including moving from IT into DFIR, and preparing for a certification.
Grouped by type. The filters narrow what is already on this page — nothing here is loaded on demand, so a print-out, a reader with JavaScript off, and a crawler all get the complete list.
Showing all 180 entries.
The spine of the discipline: what a competent examiner is expected to have done, written down by bodies a court will recognise. Read these first, and check for a newer revision before you cite one.
Scientific Working Group on Digital Evidence · Version 5.0, published 2026-07-09 · 2026 · SWGDE 17-F-001-5.0
SWGDE's guidance on analysing historical call detail records and cell site data to reason about where a handset was, and on the limits of that reasoning. The…
Forensic Science Regulator (England and Wales) · Version 2, published 5 June 2025; came into force 2 October 2025 · 2025
The statutory code of practice the Forensic Science Regulator is required to publish under the Forensic Science Regulator Act 2021, setting quality standard…
Ramaswamy Chandramouli, Eric Hibbard · National Institute of Standards and Technology · Revision 2, September 2025 · 2025 · NIST SP 800-88 Rev. 2
NIST's guidance on clearing, purging and destroying data on storage media, including media-specific techniques and verification. Revision 2 was published in…
International Organization for Standardization · Edition 1, published 2025-06 · 2025 · ISO 21043-4:2025
A 14-page international standard on the interpretation of forensic findings, published in June 2025 as part of the ISO 21043 forensic sciences series. Parts 1…
International Organization for Standardization · Edition 1, published 2025-06 · 2025 · ISO 21043-5:2025
A 10-page international standard specifying requirements for forensic reports and for the communication of findings, published June 2025 as part of the ISO…
Federal Judicial Center / National Academies of Sciences, Engineering, and Medicine · Fourth edition, published December 31, 2025 (the two volumes carry a March 2026 date) · 2025
The judiciary's own reference work on scientific and technical evidence, produced jointly by the Federal Judicial Center and the National Academies, made up…
Scientific Working Group on Digital Evidence · Version 2.1, published 2025-08-05 · 2025 · SWGDE 17-F-002-2.1
SWGDE's guidance on acquiring data from computers and computer storage, including write blocking, live versus dead acquisition, verification and the handling…
Scientific Working Group on Digital Evidence · Version 2.0, published 2025-11-20 · 2025 · SWGDE 18-F-002-2.0
SWGDE's core on-scene collection document, covering preparation, data integrity and security, acquisition approaches, hashing and documentation. The version…
Scientific Working Group on Digital Evidence · Version 2.0, published 2025-08-21 · 2025 · SWGDE 18-F-003-2.0
SWGDE's guidance on the front half of mobile device work: isolating and preserving a seized handset, handling power and network state, and choosing among…
The Sedona Conference · Post-public-comment version, October 2025 · 2025
A consensus commentary on when mobile device data is within the scope of civil discovery and how to collect and produce it proportionately, covering…
The Sedona Conference · Sixth edition, December 2025 (fifth edition February 2020, published in The Sedona Conference Journal, Volume 21) · 2025
A controlled vocabulary for ediscovery and digital information management, defining the terms that appear in ESI protocols, expert reports, and court orders.
Martin Herman, Michaela Iorga, Ahsen Michael Salim, Robert Jackson, Mark Hurst, Ross Leo, Anand Kumar Mishra, Nancy Landreville, Yien Wang · National Institute of Standards and Technology · July 2024 (final; initial public draft February 2023) · 2024 · NIST SP 800-201
The successor work to NISTIR 8006: a forensic reference architecture that maps the challenges onto the NIST cloud computing reference architecture and…
Scientific Working Group on Digital Evidence · Version 1.1, published 2024-02-02 · 2024 · SWGDE 23-Q-001-1.1
SWGDE's guidance for examiners who have to present digital evidence in court or other proceedings, covering preparation, exhibits, scope of testimony and…
Scientific Working Group on Digital Evidence · Version 2.1, published 2024-03-07 · 2024 · SWGDE 18-Q-001-2.1
SWGDE's statement of the minimum a laboratory must do to test a tool before using it in casework, including what to record about the tool, the test data and…
United States Courts (rule text as printed by the Committee on the Judiciary, U.S. House of Representatives) · Amended April 24, 2023, effective December 1, 2023; credit line in the official print reads "As amended Apr. 17, 2000, eff. Dec. 1, 2000; Apr. 26, 2011, eff. Dec. 1, 2011; Apr. 24, 2023, eff. Dec. 1, 2023." · 2023
The federal admissibility rule for expert testimony. The 2023 amendment moved the burden into the rule text — the proponent must demonstrate to the court that…
Eran Salfati, Michael Pease · National Institute of Standards and Technology · NISTIR 8428, 22 June 2022 · 2022 · NISTIR 8428
An incident-handling framework for operational technology environments, extending conventional DFIR with event-escalation-based response, OT-specific forensic…
James R. Lyle, Barbara Guttman, John Butler, Kelly Sauerwein, Christina Reed, Corrine Lloyd · National Institute of Standards and Technology · NISTIR 8354, 21 November 2022 · 2022 · NISTIR 8354
NIST's scientific foundation review of digital forensics, examining the peer-reviewed literature, academic material and practitioner guidance behind digital…
The Sedona Conference · August 2021; published in The Sedona Conference Journal, Volume 22 (2021) · 2021
A consensus commentary on auto-deleting and disappearing-message applications: whether adopting them is defensible, what happens to the preservation duty when…
International Organization for Standardization / International Electrotechnical Commission · Edition 2, published 2020-01; a systematic review closed 2025-06-05 · 2020 · ISO/IEC 27050-3:2020
A 27-page code of practice setting out requirements and guidance for each ediscovery activity, from initiating a matter and issuing preservation instructions…
Martin Herman, Michaela Iorga, Ahsen Michael Salim, Robert Jackson, Mark Hurst, Ross Leo, Richard Lee, Nancy Landreville, Anand Kumar Mishra, Yien Wang, Rodrigo Sardinas · National Institute of Standards and Technology · NISTIR 8006, final, August 2020 · 2020 · NISTIR 8006
A catalogue produced by the NIST Cloud Computing Forensic Science Working Group that aggregates and categorises the forensic challenges of investigating…
The Sedona Conference · Second edition, October 2020; published in The Sedona Conference Journal, Volume 22 (2021). The first edition dates from March 2008 · 2020
A consensus commentary on getting electronically stored information into evidence — authentication, hearsay, best evidence, and the certification routes —…
United States Courts (rule text as printed by the Committee on the Judiciary, U.S. House of Representatives) · Both subsections added by the amendment of April 27, 2017, effective December 1, 2017; text verified against the official print current to December 1, 2024 · 2017
Two subsections of Rule 902 that let a party authenticate electronic evidence by written certification instead of live testimony: 902(13) covers a record…
International Organization for Standardization / International Electrotechnical Commission · Edition 3, published 2017-11; reviewed and confirmed 2023 · 2017 · ISO/IEC 17025:2017
The 30-page accreditation standard against which forensic laboratories, including digital forensics units, are assessed for technical competence, impartiality…
The Sedona Conference · Third edition, October 2017 · 2017
Fourteen consensus principles on producing electronically stored information in civil litigation, with commentary, revised to reflect the 2015 amendments to…
European Network of Forensic Science Institutes · Version 01, November 2015 · 2015 · ENFSI-BPM-FIT-01
A 65-page manual from ENFSI's Forensic Information Technology working group covering personnel, equipment, accommodation, peer review, examination protocols,…
European Network of Forensic Science Institutes · Approved version 3.0; foreword dated 8 March 2015 · 2015
The output of ENFSI's STEOFRAE project (Strengthening the Evaluation of Forensic Results across Europe): a guideline on evaluating findings against competing…
United States Courts · Replaced in full by the amendment effective December 1, 2015 · 2015
The federal sanctions rule for lost ESI. It applies only where information that should have been preserved in the anticipation or conduct of litigation is…
International Organization for Standardization / International Electrotechnical Commission · Edition 1, published 2015-06; reviewed and confirmed 2021; a further systematic review closed 2026-09-03 · 2015 · ISO/IEC 27041:2015
An 18-page standard on showing that an investigative method is fit for purpose: capturing functional and non-functional requirements, describing the method,…
International Organization for Standardization / International Electrotechnical Commission · Edition 1, published 2015-06; reviewed and confirmed 2021; a further systematic review closed 2026-09-03 · 2015 · ISO/IEC 27042:2015
A 14-page standard that picks up where ISO/IEC 27037 stops, covering the analysis and interpretation of potential digital evidence and the competence and…
International Organization for Standardization / International Electrotechnical Commission · Edition 1, published 2015-03; reviewed and confirmed 2020; a further systematic review closed 2025-12-03 · 2015 · ISO/IEC 27043:2015
A 30-page standard setting out an idealised, process-class model for investigating incidents involving digital evidence, from readiness through…
Richard Ayers, Sam Brothers, Wayne Jansen · National Institute of Standards and Technology · Revision 1, May 2014 · 2014 · NIST SP 800-101 Rev. 1
NIST's guidance on seizing, preserving, acquiring and examining mobile phones and their associated media, including the acquisition-level model (manual,…
International Organization for Standardization / International Electrotechnical Commission · Edition 1, published 2012-10; reviewed and confirmed 2018; a further systematic review closed 2023-12-03 · 2012 · ISO/IEC 27037:2012
A 38-page international standard covering the first four handling activities for potential digital evidence: identification, collection, acquisition and…
National Institute of Justice, U.S. Department of Justice · November 2009 · 2009 · NCJ 227050
A pocket flipbook companion to NIJ's first responder guide, condensing device types, scene securing, documentation, collection and packaging into an on-scene…
Computer Crime and Intellectual Property Section, Criminal Division, U.S. Department of Justice · 2009 manual, still the version published on the CCIPS documents page · 2009
The Justice Department's own manual on the Fourth Amendment and statutory rules governing searches of computers and the acquisition of electronic evidence,…
National Institute of Justice, U.S. Department of Justice · Second edition, April 2008 · 2008 · NCJ 219941
NIJ's first-responder guide covering electronic device types and their potential evidence, on-scene tools and equipment, securing and documenting the scene,…
The Sedona Conference · July 2008; reprinted in The Sedona Conference Journal, Volume 10 Supplement · 2008
A short statement, endorsed by a large number of federal and state judges, that discovery is a non-adversarial exchange and that counsel have an obligation to…
National Institute of Justice, U.S. Department of Justice · January 2007 · 2007 · NCJ 211314
An 81-page NIJ guide on the legal handling of digital evidence: search and seizure issues including the Fourth Amendment, the Electronic Communications…
Karen Kent, Suzanne Chevalier, Tim Grance, Hung Dang · National Institute of Standards and Technology · August 2006 (final, published 1 September 2006) · 2006 · NIST SP 800-86
A NIST Special Publication that sets out a four-phase forensic process (collection, examination, analysis, reporting) and applies it to four data sources:…
National Institute of Justice, U.S. Department of Justice · April 2004 · 2004 · NCJ 199408
An NIJ special report, produced by the Technical Working Group for the Examination of Digital Evidence, covering policy and procedure, evidence assessment,…
Supreme Court of the United States · Decided March 23, 1999 · 1999 · 526 U.S. 137
The decision extending the Daubert gatekeeping obligation to all expert testimony under Rule 702, including technical and other specialized knowledge, and…
Supreme Court of the United States · Decided June 28, 1993 · 1993 · 509 U.S. 579
The decision holding that the Federal Rules of Evidence, not Frye's general-acceptance test, govern expert scientific testimony, and that the trial judge acts…
United States Courts (rule text as printed by the Committee on the Judiciary, U.S. House of Representatives) · Enacted January 2, 1975; restyled by the amendment effective December 1, 2011; text verified against the official print current to December 1, 2024 · 1975
An illustration of sufficient authentication: "Evidence describing a process or system and showing that it produces an accurate result." It is the route by…
American Bar Association · Current text of Comment [8] as published by the ABA and verified on 2026-09-12
The comment on maintaining competence, which provides that to maintain the requisite knowledge and skill a lawyer should keep abreast of changes in the law…
Forensic Science Regulator (England and Wales) · Issue 4; gov.uk page last updated 22 July 2024 · FSR-G-200
Guidance on the content of reports issued by expert witnesses in the criminal justice system of England and Wales, setting out the legal requirements for…
INTERPOL
INTERPOL's guidance on establishing and managing a digital forensics laboratory, together with technical guidelines for managing and processing electronic…
Forensic Science Regulator (England and Wales) · Issue 2; gov.uk page last updated 22 July 2024 · FSR-G-218
The Regulator's guidance on applying the validation requirements of the code of practice to digital forensic methods: demonstrating that a method is fit for…
Organization of Scientific Area Committees for Forensic Science, National Institute of Standards and Technology
A NIST-administered repository of forensic science standards that have passed technical and quality review by practitioners, researchers, statisticians and…
Scientific Working Group on Digital Evidence
SWGDE's own listing of its published best practices, guidelines, technical notes, positions and considerations for digital and multimedia forensics, together…
Association of Chief Police Officers · March 2012 · 2012
The UK guide that states the four ACPO principles for handling digital evidence — do not change the original data, record everything done, have a competent…
Long-form texts. A few are twenty years old and still the only complete account of their subject; others have aged into museum pieces. Each entry says which.
Michael R. Arkfeld · LexisNexis · Fourth edition, with the April 2026 update; supplied with four cross-referenced Best Practices Guides · 2026 · ISBN 9781632840394 (print); ISBN 9781632840400 (ePub)
A roughly 1,500-page updated treatise covering discovery and admission of electronic evidence against federal and state rules and case law, in eight chapters,…
Kara Nance, Chris Eagle · No Starch Press · Second edition · 2026 · ISBN 978-1-7185-0468-4
The reference manual for Ghidra: core reverse-engineering technique, Ghidra's data displays, the decompiler, collaborative server-based analysis,…
Ganesh Ramakrishnan, Mansoor Haqanee · Packt Publishing · First edition · 2024 · ISBN 978-1-80056-441-1
Investigation in cloud environments using native tooling and logs alongside conventional forensic technique: AWS, Azure and Google Cloud, then Microsoft 365,…
Amelia Phillips, Bill Nelson, Christopher Steuart · Course Technology (Cengage) · 2024 · ISBN 978-0-357-67288-4
The long-running course textbook for digital forensics programmes: lab setup and policy, acquisition, operating-system and email and mobile artifacts, report…
Gerard Johansen · Packt Publishing · Third edition · 2022 · ISBN 978-1-80323-867-8
Forensics placed inside the incident response lifecycle: building a response capability, response frameworks, evidence acquisition, volatile memory, disk and…
Christian Hummert, Dirk Pawlaszczyk (editors) · Springer · First edition · 2022 · ISBN 978-3-030-98466-3
An open-access reference to the structures underneath mobile evidence, in two parts: mobile file systems (APFS, Ext4, F2FS, QNX6) and the serialisation…
Patrick Wardle · No Starch Press · 2022 · ISBN 978-1-7185-0194-2
Volume I of a series on macOS malware: infection and delivery methods, the persistence mechanisms available on macOS, and static and dynamic analysis of…
Bruce Nikkel · No Starch Press · 2021 · ISBN 978-1-7185-0196-6
Postmortem analysis of Linux systems from the operating system's own structures outward: partition tables and LVM, Linux file systems, directory layout, the…
Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty · Packt Publishing · Fourth edition · 2020 · ISBN 978-1-83864-752-0
A device-by-device walkthrough of mobile acquisition and analysis: iOS and Android internals and file systems, logical and physical extraction, app and SQLite…
Harlan Carvey · Academic Press (Elsevier) · First edition · 2018 · ISBN 978-0-12-811415-5
Case-driven walkthroughs of Windows examinations where the narration is the analyst's thought process: what question is being asked, which artifact is chosen…
Dennis Andriesse · No Starch Press · First edition · 2018 · ISBN 978-1-59327-912-7
Binary analysis from the format upward on Linux: ELF and PE structure, writing a loader with libbfd, how disassembly actually works and where it goes wrong,…
Chris Sanders · No Starch Press · Third edition · 2017 · ISBN 978-1-59327-802-1
How to read a packet capture with Wireshark: capture placement and filtering, the protocols you will actually meet, and worked scenarios that move from a…
Pavel Yosifovich, Mark E. Russinovich, Alex Ionescu, David A. Solomon · Microsoft Press (Pearson) · Seventh edition · 2017 · ISBN 978-0-7356-8418-8
The reference documentation of how Windows actually works: the object manager, processes and threads, virtual memory, handles, tokens and the security model,…
Brett Shavers, John Bair · Syngress (Elsevier) · First edition · 2016 · ISBN 978-0-12-803340-1
A survey of covert communication methods an investigator will run into — Tor and TAILS, steganography, encrypted messaging, anti-forensic tooling — and what…
Jaron Bradley · Syngress (Elsevier) · First edition · 2016 · ISBN 978-0-12-804456-8
Live response and postmortem analysis on macOS using bash and Python tooling the reader writes: startup and persistence mechanisms, scheduling, browser…
Bruce Nikkel · No Starch Press · 2016 · ISBN 978-1-59327-793-2
The acquisition half of the job done properly with Linux command-line tools: write protection, image formats, attaching subject media, image management and…
Harlan Carvey · Syngress (Elsevier) · Second edition · 2016 · ISBN 978-0-12-803291-6
The standing treatment of the Windows registry as evidence: hive file structure, the tools and process for parsing it, then separate analysis passes over the…
Jason T. Luttgens, Matthew Pepe, Kevin Mandia (with Ryan Kazanciyan) · McGraw-Hill Education · Third edition · 2014 · ISBN 978-0-07-179868-6
The incident response process as a discipline: preparation, detection and initial response, live collection from Windows and Unix, forensic duplication,…
Michael Hale Ligh, Andrew Case, Jamie Levy, AAron Walters · Wiley · First edition · 2014 · ISBN 978-1-118-82509-9
Memory acquisition and analysis across Windows, Linux and macOS, written by the people who built Volatility: process and kernel structures, code injection,…
Harlan Carvey · Syngress (Elsevier) · Fourth edition · 2014 · ISBN 978-0-12-417157-2
An artifact-by-artifact working guide to Windows examination: Volume Shadow Copies, file metadata, registry analysis, malware detection on a dead box,…
Brett Shavers · Syngress (Elsevier) · First edition · 2013 · ISBN 978-1-59749-985-9
A book about the attribution gap: how you get from "this account or this machine did it" to "this person did it", using physical investigation, surveillance,…
Richard Bejtlich · No Starch Press · 2013 · ISBN 978-1-59327-509-9
How to build and run network security monitoring: where to place sensors, what to collect (full packet capture, session data, alert data), and how to work a…
Michael Sikorski, Andrew Honig · No Starch Press · First edition · 2012 · ISBN 978-1-59327-290-6
A course in Windows malware analysis built around sixty-odd labs with real samples: safe lab construction, static and dynamic analysis, x86 disassembly,…
Eoghan Casey · Academic Press (Elsevier) · Third edition · 2011 · ISBN 978-0-12-374268-1
A single-author treatment of digital evidence that puts investigative reasoning and admissibility ahead of tooling, then works through Windows, Unix,…
Brian Carrier · Addison-Wesley Professional · First edition · 2005 · ISBN 978-0-321-26817-4
A byte-level reference to volume and file system structures: DOS/MBR, GPT, Apple, BSD and Solaris partitioning, then the on-disk layout and recovery behaviour…
Dan Farmer, Wietse Venema · Addison-Wesley Professional · First edition · 2004 · ISBN 978-0-201-63497-6
A short, dense book about the physics of digital evidence: the order of volatility, how long deleted data actually persists, what abstraction layers hide, and…
Fred Chris Smith, Rebecca Gurley Bace · Addison-Wesley Professional · First edition · 2002 · ISBN 978-0-201-75279-3
A book for technologists who are about to testify: how the gatekeeping standards work, how to establish and defend qualifications, how to present technical…
Where the research is published. Useful when you need a defensible answer about error, uncertainty or a method's limits, rather than a procedure.
Springer · 2025 · ISBN 978-3-031-71024-7 (Advances in Digital Forensics XX)
The post-conference edited volumes of the annual IFIP Working Group 11.9 International Conference on Digital Forensics, published by Springer as the numbered…
Elsevier · 2020 · ISSN 2666-2817
The main peer-reviewed research journal for digital forensics. It was called Digital Investigation from 2004 through 2019 and was folded into Elsevier's…
Elsevier · 2019 · ISSN 2589-871X
A fully open-access journal in Elsevier's Forensic Science International family, indexed in DOAJ under Creative Commons licences and funded by article…
Journal of Law & Cyber Warfare · 2012 · ISSN 2578-6229 (online), 2578-6245 (print)
A peer-reviewed law journal founded in 2012 covering the law of cyber conflict — attribution and evidence, sovereignty, national security policy, autonomous…
Digital Forensic Research Workshop (DFRWS) · 2001
The peer-reviewed paper track of the DFRWS conferences, which have run since the first workshop in 2001 and now cover three regions — DFRWS USA, DFRWS EU…
American Academy of Forensic Sciences / Wiley · ISSN 0022-1198 (print), 1556-4029 (online)
The flagship journal of the American Academy of Forensic Sciences, published by Wiley. AAFS runs a Digital & Multimedia Sciences section (now styled Forensic…
Chartered Society of Forensic Sciences / Elsevier · ISSN 1355-0306
The peer-reviewed journal of the Chartered Society of Forensic Sciences, published by Elsevier. The Society describes it as focusing on the collection and use…
Association of Digital Forensics, Security and Law (ADFSL), hosted by Embry-Riddle Aeronautical University · 2006 · ISSN 1558-7223
An open-access, double-blind peer-reviewed journal that deliberately sat at the intersection of digital forensics, security and law, published by ADFSL and…
Elsevier · 2004 · ISSN 1742-2876
The predecessor title of Forensic Science International: Digital Investigation. It published from 2004 to 2019 under ISSN 1742-2876 and then the title…
Economic Crime Institute, Utica College · 2002
A defunct early journal of the field. IJDE published from Volume 1, Issue 1 (Spring 2002) to Volume 6, Issue 1 (Spring 2007) out of Utica College's Economic…
Individual papers and reports that get cited on their own — foundational definitions, scientific-foundation reviews, and the handful of articles that set the vocabulary everyone else uses.
Elsevier (Forensic Science International: Digital Investigation) · 2020 · DOI 10.1016/j.fsidi.2019.200888
Eoghan Casey's paper in Forensic Science International: Digital Investigation on how digital forensic practitioners should form and state evaluative opinions,…
Eoghan Casey, Sean Barnum, Ryan Griffith, Jonathan Snyder, Harm van Beek, Alexander J. Nelson · Digital Investigation (Elsevier) · Digital Investigation, volume 22, September 2017 · 2017 · doi:10.1016/j.diin.2017.08.002
The paper that introduced CASE, the Cyber-investigation Analysis Standard Expression, an open community-developed specification language aligned with the…
Hon. Paul W. Grimm, Daniel J. Capra & Gregory P. Joseph · Baylor Law Review, 69 Baylor L. Rev. 1 (2017) · 69 Baylor Law Review 1, Winter 2016-2017 issue · 2017
A law review article by a federal judge who writes extensively on digital evidence, the Reporter to the Advisory Committee on Evidence Rules, and a leading…
Executive Office of the President, President's Council of Advisors on Science and Technology · September 2016 · 2016
A presidential advisory report distinguishing foundational validity — whether a method works at all, shown by empirical studies with measured error rates —…
Elsevier (Digital Investigation) · 2010 · DOI 10.1016/j.diin.2010.05.009
Simson Garfinkel's 2010 paper in Digital Investigation arguing that the 'golden age' of digital forensics was ending and naming the forces that would end it:…
Elsevier (Digital Investigation) · 2009 · DOI 10.1016/j.diin.2009.06.016
Garfinkel, Farrell, Roussev and Dinolt's DFRWS 2009 paper, published in Digital Investigation, arguing that digital forensics could not be a science without…
National Research Council / The National Academies Press · 2009 consensus study report · 2009 · DOI 10.17226/12589; ISBN 0-309-13130-8 (paperback)
The congressionally requested report that found much of US forensic practice lacked demonstrated validity, consistent standards, and independence from law…
International Journal of Digital Evidence · 2003
Brian Carrier's paper in IJDE 2003, Volume 1, Issue 4, which modelled forensic tools as stacks of abstraction layers — bytes to file system to file to…
International Journal of Digital Evidence · 2002
Eoghan Casey's paper in IJDE 2002, Volume 1, Issue 2, which took apart the then-common claim that digital evidence is exact and argued that error, uncertainty…
Digital Forensic Research Workshop (DFRWS) · 2001
The report from the first Digital Forensic Research Workshop, held in 2001, which set out a research agenda and a shared vocabulary for a field that at that…
Documentation, not downloads. What each tool is genuinely for, and — more usefully — what it is not for.
Arsenal Recon · 2026
A Windows tool that mounts raw, forensic, and virtual machine disk images as complete physical disks rather than as individual volumes, which is what lets…
Sleuth Kit Labs · Autopsy 4 · 2026
An open-source graphical forensic platform built over The Sleuth Kit, with an ingest-module architecture for keyword search, hash matching, web and email…
Belkasoft · 2026
Belkasoft's flagship acquisition and analysis product, covering computer, mobile, drone, vehicle, and cloud evidence in one case. It is split by customer…
Simson Garfinkel · bulk_extractor 2 · 2026
An open-source scanner that reads a disk image, memory image, or directory from end to end and extracts features — email addresses, URLs, credit card numbers,…
CAINE project (Nanni Bassetti); Tsurugi Linux project · CAINE 14 / Tsurugi 26.03 · 2026
Two maintained live Linux distributions assembled for digital forensics. CAINE 14 'Lightstream' is built on Ubuntu 24.04 and is notable for a write-blocking…
Cellebrite · Inseyets · 2026
Cellebrite's mobile forensics flagship, now branded Inseyets and positioned within the company's broader Case-to-Closure platform. The familiar component…
GCHQ · CyberChef 11 · 2026
A browser-based tool published by GCHQ that chains together hundreds of data operations — encodings, ciphers, compression, hashing, timestamp conversion,…
sqlitebrowser project · 3.13 · 2026
An open-source cross-platform GUI for creating, browsing, querying, and editing SQLite and SQLCipher databases, with a spreadsheet-like table view and a full…
Eric Zimmerman · 2026
A large collection of free single-purpose Windows artefact parsers — among them MFTECmd, PECmd, LECmd, JLECmd, AmcacheParser, SBECmd, EvtxECmd, RECmd, and the…
Exterro · 2026
The long-established Forensic Toolkit, originally AccessData's and now owned and sold by Exterro, which acquired the product line. It covers processing of…
Exterro · 2026
A free Windows imaging and preview tool, originally from AccessData and now distributed by Exterro, which acquired the FTK line. It creates raw, E01, and AD1…
U.S. National Security Agency · Ghidra 12 · 2026
An open-source software reverse engineering framework released by the NSA, with a disassembler, a decompiler producing C-like output, scripting in Java and…
hashcat project; Openwall · Hashcat 7 · 2026
The two standard open-source password recovery tools. Hashcat is GPU-driven and supports a very wide range of hash and container formats with dictionary,…
Yamato Security; WithSecure · Hayabusa 4 / Chainsaw 2 · 2026
Two open-source Rust tools that apply Sigma and their own rules directly to Windows event log (EVTX) files and produce a prioritised, timeline-ordered set of…
Alexis Brignoni · 2026
A family of open-source Python parsers for mobile and returns data: iLEAPP for iOS logs, events and plists, ALEAPP for Android, and RLEAPP for returns and…
Eric Zimmerman · Kroll · 2026
A Kroll-owned Windows triage tool that collects forensically relevant files from a live or mounted system using configurable Targets, then runs parsers over…
Joachim Metz · libyal · 2026
An open-source library and tool set for the Expert Witness Compression Format (E01/Ex01), including ewfacquire to create images, ewfverify to check their…
Magnet Forensics · 2026
A commercial digital forensics platform that acquires, processes, and reports on computer, mobile, cloud, and vehicle data in a single case, organised around…
Ulf Frisk · MemProcFS 5 · 2026
An open-source memory forensics tool that mounts a RAM image (or live memory) as a virtual file system, so processes, handles, registry, and network state…
MSAB · 2026
A commercial mobile forensics family from the Swedish vendor MSAB, sold as separate modules rather than one product: XRY Logical for live and file system…
Nuix · 2026
A commercial investigation and data-processing platform aimed at very large unstructured data sets, combining forensic-style processing with ediscovery-grade…
The Plaso project · 2026
An open-source Python framework that extracts timestamps from hundreds of artefact types across a disk image or directory and writes them into a single…
radareorg; RizinOrg · radare2 6 / Rizin 0.9 · 2026
Two closely related open-source reverse engineering frameworks. radare2 is the original Unix-style command-line toolkit for binary analysis, patching, and…
Harlan Carvey · RegRipper 3.0 · 2026
An open-source Perl tool that runs a library of plugins against Windows registry hives and reports the values that matter forensically, with each plugin…
Rob Lee and the SIFT team · SANS Institute · 2026
A free Ubuntu LTS-based virtual machine appliance from SANS that bundles more than a hundred open-source incident response and forensic tools, pre-configured…
SigmaHQ · 2026
An open, structured YAML format for describing detections in log data, plus a community rule repository and the pySigma/sigma-cli tooling that converts a rule…
Brian Carrier · Sleuth Kit Labs · TSK 4 · 2026
A C library and a set of command-line tools (fls, icat, istat, mmls, blkls, tsk_recover and others) that read volume systems and file systems directly from a…
Timesketch project (code owned by Google) · 2026
An open-source web application for collaborative timeline analysis, built around the idea of a sketch that several analysts annotate, tag, and search at once.…
Rapid7 · Velociraptor 0.77 · 2026
An open-source endpoint visibility and DFIR platform built around VQL, a query language for collecting artefacts, monitoring events, and hunting across a…
The Volatility Foundation · Volatility 3 · 2026
An open-source memory analysis framework that parses RAM images into processes, network state, loaded modules, injected code, registry hives resident in…
Wireshark Foundation · 2026
The standard open-source packet analyser, with a GUI, the tshark command-line equivalent, several thousand protocol dissectors, and a display filter language.…
X-Ways Software Technology AG · 2026
A commercial Windows forensic examination environment from the German publisher X-Ways Software Technology AG, built on their WinHex disk editor and known for…
VirusTotal · YARA 4 / YARA-X 1 · 2026
A pattern-matching language and scanner for identifying files by their content — strings, byte sequences, and structural conditions — used to label malware…
The Zeek Project; Open Information Security Foundation (OISF) · Zeek 8 / Suricata 8 · 2026
Two complementary open-source network monitoring engines, both actively released. Zeek (formerly Bro) turns traffic into structured, protocol-aware logs —…
National Institute of Standards and Technology
NIST's long-running programme that builds tool specifications, test assertions, test procedures and test data for categories of forensic function — disk…
National Institute of Standards and Technology
A CFTT offshoot that packages NIST's test methodology so labs can run it themselves and optionally share results: distributed as bootable Linux ISOs and a…
Images, corpora and challenges you can practise on and publish against. The only honest way to learn a technique is on data whose ground truth someone else already knows.
DFRWS · 2023
The annual research challenges set alongside the DFRWS conferences, with scenario data, documentation and published results kept as repositories in the DFRWS…
Simson Garfinkel and contributors · Digital Corpora · 2009
A public repository of forensic disk images, memory dumps, mobile extractions, network packet captures and file corpora assembled for forensic research and…
Simson Garfinkel and contributors · Digital Corpora · 2009
A corpus of 986,278 real files harvested from US government web servers, distributed as numbered archives on Digital Corpora. The published statistical report…
Digital Corpora · 2009
A scripted corporate scenario covering the first four weeks of a fictional patent-search company, from 13 November 2009 to 12 December 2009. It ships daily…
Ali Hadi
A set of eleven numbered DFIR challenges plus additional memory forensics, unallocated-space and Linux cases published by Ali Hadi, each with the scenario and…
Centri
A gamified platform, run by Centri, of "security investigations and challenges covering; Incident Response, Digital Forensics, Security Operations, Reverse…
National Institute of Standards and Technology
A NIST repository of documented simulated digital evidence — images and data sets with known ground truth — developed with National Institute of Justice…
CyberDefenders
A blue-team lab platform hosting scenario-based investigations grouped as endpoint forensics, network forensics, malware analysis, cloud forensics, threat…
ForensicArtifacts
A community-maintained, machine-readable knowledge base of digital forensic artefact definitions — where an artefact lives and how to collect it — expressed…
Joshua Hickman · The Binary Hick
A maintained index of populated mobile test images produced by Joshua Hickman and linked from his blog: Android 7 through 14, and iOS 13, 14 (with a macOS Big…
National Institute of Standards and Technology
A NIST library of collected software, supported by DHS and law enforcement partners, from which file profiles are computed and published as the Reference Data…
Where the field talks to itself. Split roughly between research venues and vendor user conferences; the entries say which is which.
American Academy of Forensic Sciences · 2027
The annual meeting of the American Academy of Forensic Sciences, a multidisciplinary body of over 6,500 members organised into twelve sections, one of which…
Cellebrite · 2026
Cellebrite's customer event programme. Through 2026 the listing is dominated by regional user forums and government forums — Toronto, Halifax, Bern, Seattle,…
Forum of Incident Response and Security Teams · 2026
The annual conference of FIRST, the global forum of incident response and security teams, which comprises over 800 member teams in more than 100 countries.…
High Technology Cyber Investigation Association · 2026
HTCIA, founded in 1986 and describing itself as "the oldest association exclusively dedicated to advancing high technology and cyber investigations", runs a…
International Association of Computer Investigative Specialists · 2026
IACIS runs "an annual training event in Orlando, Florida the last week of April and the first week of May each year", with the next Orlando conference…
Magnet Forensics · 2026
Magnet Forensics' online DFIR conference, delivered over several weeks of sessions. The 2026 edition has taken place and its recordings are published as a…
Relativity · 2026
Relativity's annual user and legal-technology conference, now branded RelFest. The main 2026 event is RelFest Chicago, 29 September to 1 October 2026 at the…
SANS Institute · 2026
SANS's annual practitioner summit, with the 2026 edition running 15-16 October 2026 at the Hilton Arlington Rosslyn in Arlington, Virginia, followed by SANS…
Comexposium · 2026
A long-running US digital forensics and investigations conference, now produced by Comexposium. The site lists one 2026 edition: San Diego, California, 20-22…
DFRWS
The research conference series for digital forensics, running as DFRWS USA (July), a European edition renamed the Digital Forensics Conference Europe from…
Independent and vendor blogs and video channels. The fastest-moving layer of the literature, and the first place a new artefact gets documented.
Richard Davis
A YouTube channel and companion training site covering Windows, Linux and macOS endpoint forensics, memory analysis and threat hunting. The YouTube videos are…
Devon Ackerman and contributors
A curated DFIR reference index — training and degree programmes, certifications, job postings, tools by platform, conferences, podcasts, preservation letter…
A DFIR blog aimed explicitly at beginners, paired with a searchable training directory at training.dfirdiva.com that indexes over 500 free and low-cost…
Brett Shavers
Brett Shavers' DFIR portal: a calendar of training events worldwide, a tool directory, a resource library, a book index and a blog on the state of the field.…
The long-running digital forensics news site and discussion forum, publishing articles, interviews, tool announcements and a regular digest, alongside…
The research blog of Hexordia, a mobile forensics training and consulting firm, with posts from a named group of contributors including Jessica Hyde, Adam…
Alexis Brignoni
Alexis Brignoni's blog on mobile forensics and open-source tooling, closely tied to the xLEAPP family of parsers — iLEAPP, ALEAPP, RLEAPP and VLEAPP — which…
Magnet Forensics' blog and resource library, mixing artifact research and how-to posts with webinars, white papers, case studies and product content across…
The DFIR section of the SANS institutional blog, written by SANS instructors and course authors on topics tied to their teaching — cloud imaging, ransomware…
A daily handler diary — distinct from the SANS DFIR blog — in which a rotating roster of volunteer handlers writes up whatever they are currently seeing in…
Joshua Hickman
A research blog by Joshua Hickman covering mobile and Apple-platform artifacts, timestamp semantics and the test images he builds and publishes for the…
Phill Moore
A weekly roundup of everything published in digital forensics that week — blog posts, tool releases, presentations, podcasts and job listings — with links and…
Harlan Carvey
Harlan Carvey's long-running blog on Windows incident response, registry analysis, investigative methodology and the discipline of documenting how you reached…
David Cowen
David Cowen's daily-blog project, running to over 800 numbered posts plus the Sunday Funday challenges, Solution Saturday write-ups and the Forensic Lunch…
A macOS and iOS forensic research blog, authored under the handle @iamevltwin with occasional contributors, covering Apple artifacts, analysis tooling and…
Interview and news shows. Good for keeping current and for hearing how practitioners actually talk about a problem; not a substitute for training.
Alexis Brignoni and Heather Charpentier · 2023
A podcast hosted by Alexis Brignoni and Heather Charpentier, both working examiners, covering current digital forensics news, new research and interviews with…
The interview podcast from Forensic Focus, featuring researchers, vendors and police digital forensics staff on their current work. Recent guests include Ben…
A short daily audio briefing, typically five to ten minutes, summarising the Internet Storm Center diaries and the day's notable vulnerabilities and…
Sharon D. Nelson and John W. Simek
A Legal Talk Network podcast hosted by Sharon D. Nelson and John W. Simek on digital forensics, ediscovery and information security for a legal audience.
Training that genuinely costs nothing, plus a few that are free to start. Where something is only partly free, the entry says exactly which part.
2016
A free eight-hour online unit from The Open University on its OpenLearn platform, classified as Level 3 (advanced undergraduate entry), with a free statement…
Antisyphon runs selected courses on a Pay What You Can model, stating that it wants to help people who cannot afford conventional training prices. Courses…
A DFIR training company that publishes a substantial block of genuinely free self-paced courses alongside its paid catalogue. Confirmed free titles include…
An Open edX platform hosting long-form, university-length classes in low-level computing: x86-64 assembly, OS internals, firmware and UEFI, debuggers (WinDbg,…
A download library of reference posters and cheat sheets, of which 37 are filed under Digital Forensics and Incident Response — artifact maps, timestamp…
TCM Security Academy publishes six courses explicitly marked Free Course: AI 100: Fundamentals (4h), Linux 100: Fundamentals (2h), Practical Help Desk (16h…
A browser-based hands-on security learning platform. The free tier gives limited access to learning paths, access to rooms marked free, and one hour of…
The Volatility Foundation keeps the Volatility Framework — currently Volatility 3 — free and open source on GitHub, with the accompanying project…
Every entry was checked against the publisher’s own page, and each one prints the date that check was made. Where an edition, an ISBN or a standard number could not be confirmed at source, the field is left off rather than reconstructed — a wrong standard number is the one error on a page like this that propagates into other people’s work.
Standards are revised. ISO reaffirms or replaces on a roughly five-year cycle, SWGDE revises continuously, and NIST withdraws publications outright. Treat every version label here as “what was current on the verification date” and confirm at source before you cite it.
Inclusion is not endorsement, and nothing here is legal advice. Several entries are listed precisely because a reader will meet them in an opponent’s report and needs to know what they do and do not establish.