Free DFIR tooling and reference material
The open-source tools and free cheat sheets working examiners actually use daily — Eric Zimmerman's tool set and the SANS DFIR poster and cheat-sheet library.
Type: Free & low-costWorking practitionersStudentsLaw enforcement & investigators
Offered by Eric Zimmerman, SANS and the DFIR community
The facts
- Cost
- Free. Eric Zimmerman's tools are open source, with development funding and support credited to SANS and SANS DFIR. The SANS poster library lists a Digital Forensics and Incident Response category with 37 resources.Figure read 2026-09-12 from ericzimmerman.github.io
- Prerequisites
- You need to know what you are looking for. These are instruments and quick references, not instruction.
- Format
- Downloadable command-line and GUI tools, plus printable posters and cheat sheets covering artefacts, timelines and triage.
- Length
- Ongoing; this is a working reference, not a course.
- Renewal
- No renewal or recertification requirement is published for this entry.
- Accreditation
- No accreditation is claimed for this entry, and none should be inferred.
- Who it suits
- Every practitioner, at every budget. Nobody should be paying for artefact parsing before they have used these.
- Audience
- Working practitioners · Students · Law enforcement & investigators
- Official page
- ericzimmerman.github.io
Strengths
- These tools are the de facto standard for Windows artefact parsing, and they cost nothing.
- The cheat sheets compress the artefact knowledge that expensive courses spend days on into pages you can pin up.
- Open source means the parsing logic is inspectable, which is worth a great deal when you have to explain output under oath.
Limitations
- Tools and references are not training: they assume you already know which artefact answers your question.
- There is no credential, no assessment and no support contract.
- The author's own paid instruction is delivered as SANS courses at SANS prices, so there is no cheap route to being taught by him directly.
- Free tooling puts the burden of validation on you — see the NIST CFTT entry for why that matters.
Sources
Costs, prerequisites and exam formats in this field change often, and several providers price by region, cohort or employer agreement. Every figure on this page carries the date it was read and a link to the page it was read from. Confirm current terms with the provider before you spend anything.