Best Digital Forensics Software in 2026
Updated
In short: Paraben E3 Forensic Platform is ranked #1 of 29 as of 5 October 2026, ahead of NetworkMiner and Cellebrite Inseyets. The best-ranked option with a free plan is NetworkMiner. The lowest first paid tier on this page is Exterro FTK Imager at $41.58/mo.
Investigations can involve evidence from different sources and methods of examination. Compared on evidence sources, disk imaging, memory forensics and mobile forensics, these tools also vary in supported platforms and export formats. Case collaboration may be relevant when findings need to be shared; free-plan availability and paid-from pricing provide cost context. Paraben E3 Forensic Platform, NetworkMiner and Cellebrite Inseyets are among the software shown. Consider the evidence types and investigative steps in scope, then compare the listed capabilities for collection, examination and handling.
29 digital forensics software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
29ranked
8free plans on this page
$41.58/molowest paid tier
5 Oct 2026last checked
Input list Digital Forensics Software 25 channels on this page · 127 of 200 spec lines stated by the makers
Ch Tool Free planPaid fromEvidence sourcesMobile forensicsDisk imagingMemory forensicsCase collaborationSupported platforms Spec sheet Score
01 Paraben E3 Forensic Platform Free planNoPaid from$699/yrEvidence sourcesSmartphones, computers, disk images, memory dumps, email, chat databases, cloud services, social media, IoT devices, game consoles, archives, and OSINT dataMobile forensicsYesDisk imagingYesMemory forensicsYesCase collaborationYesSupported platformsWindows 10/11 64-bit; analyzes Windows, Linux, and Mac file systems 8/8spec lines stated 7.7
02 NetworkMiner Free planYesPaid fromnot statedEvidence sourcesnot statedMobile forensicsnot statedDisk imagingnot statedMemory forensicsnot statedCase collaborationnot statedSupported platformsnot stated 1/8spec lines stated 7.2
03 Cellebrite Inseyets Free plannot statedPaid fromnot statedEvidence sourcesiOS devices; Android devices; mobile applications; cloud data; encrypted and containerized files; SIM cards; portable media; UAV evidenceMobile forensicsYesDisk imagingnot statedMemory forensicsnot statedCase collaborationYesSupported platformsiOS, Android, cloud, on-premises, hybrid 4/8spec lines stated 7.1
04 Plaso Free planYesPaid fromnot statedEvidence sourcesStorage-media images, files, directories, devices, logs, databases, Windows Registry data, Android and iOS artifactsMobile forensicsYesDisk imagingYesMemory forensicsnot statedCase collaborationnot statedSupported platformsLinux, macOS, Windows, Docker 5/8spec lines stated 7.1
05 Volatility 3 Free planYesPaid fromnot statedEvidence sourcesvolatile memory (RAM) samples and memory images from Windows, Linux, and macOSMobile forensicsNoDisk imagingNoMemory forensicsYesCase collaborationnot statedSupported platformsWindows, macOS, Linux 6/8spec lines stated 7.0
06 Arkime Free planYesPaid fromnot statedEvidence sourcesnot statedMobile forensicsnot statedDisk imagingnot statedMemory forensicsnot statedCase collaborationnot statedSupported platformsnot stated 1/8spec lines stated 6.9
07 Exterro FTK Imager Free planYesPaid fromnot statedEvidence sourcesLive enterprise endpoints; Windows, macOS, and selected Linux artifacts; Microsoft 365; Exchange; SharePoint; OneDrive; Google Workspace; Gmail; Google Drive; Slack; Microsoft Teams; Confluence; AFF4; E01; AD1; RAW/DDMobile forensicsNoDisk imagingYesMemory forensicsYesCase collaborationYesSupported platformsWindows, macOS, Linux 7/8spec lines stated 6.9
08 Magnet AXIOM Cyber Free planNoPaid fromnot statedEvidence sourcesMobile devices; computer drives and forensic images; Windows, macOS, Linux, and Chromebook files and folders; Windows memory dumps; cloud services; remote endpointsMobile forensicsYesDisk imagingYesMemory forensicsYesCase collaborationYesSupported platformsWindows; macOS; Linux; Chromebook; cloud environments 7/8spec lines stated 6.9
09 CAINE Free planYesPaid fromnot statedEvidence sourcesraw/dd disk images; EnCase files; databases; internet histories; Windows registries; deleted files; EXIF data; volatile memory dumps; Android and iPod devicesMobile forensicsYesDisk imagingYesMemory forensicsYesCase collaborationnot statedSupported platformsLinux; Windows forensic side tools 6/8spec lines stated 6.8
10 SUMURI PALADIN Free planYesPaid fromnot statedEvidence sourcesDisk images, local disks, logical files, unallocated-space images, Autopsy Logical Imager results, XRY text exports, mobile and vehicle dataMobile forensicsYesDisk imagingYesMemory forensicsYesCase collaborationnot statedSupported platformsLinux live environment; 64-bit and 32-bit PC hardware 6/8spec lines stated 6.8
11 Tsurugi Linux Free planYesPaid fromnot statedEvidence sourcesdisk images; volatile memory; mobile devices; file systems; OS artifacts; cloud environments; virtual machines; network dataMobile forensicsYesDisk imagingYesMemory forensicsYesCase collaborationnot statedSupported platformsLinux 64-bit; Ubuntu 24.04.3 LTS; VirtualBox; VMware 6/8spec lines stated 6.7
12 SUMURI RECON LAB Free planNoPaid fromnot statedEvidence sourcesmacOS, Windows, Linux, iOS, Android, Google Takeout, AFF4 images, Cellebrite extractions, GrayKey backups, ADB Android backupsMobile forensicsYesDisk imagingYesMemory forensicsnot statedCase collaborationYesSupported platformsmacOS; Windows Case Reader 6/8spec lines stated 6.4
13 X-Ways Forensics Free planNoPaid fromnot statedEvidence sourcesRaw DD images, ISO, VHD, VHDX, VDI, VMDK, physical disks, RAIDs, filesystems, Android/iOS data imported through third-party tools, iTunes backupsMobile forensicsYesDisk imagingYesMemory forensicsYesCase collaborationYesSupported platformsWindows 7/8/8.1/10/11 and Windows Server 2008/2012/2016/2019/2022/2025 7/8spec lines stated 6.3
14 Hayabusa Free plannot statedPaid fromnot statedEvidence sourcesWindows event logs (EVTX)Mobile forensicsNoDisk imagingNoMemory forensicsNoCase collaborationNoSupported platformsWindows, macOS, Linux 6/8spec lines stated 6.2
15 OpenText Forensic Free plannot statedPaid fromnot statedEvidence sourcesWindows, macOS, Linux, mobile devices and backups, removable drives, encrypted volumes, Microsoft 365, Facebook, cloud storage, file systemsMobile forensicsYesDisk imagingYesMemory forensicsnot statedCase collaborationnot statedSupported platformsWindows, macOS, Linux, mobile devices, cloud platforms 4/8spec lines stated 6.2
16 Elcomsoft Mobile Forensic Bundle Free planNoPaid fromnot statedEvidence sourcesiOS devices, iOS backups, iCloud, Microsoft accounts, Google accounts, Windows devices, file-system imagesMobile forensicsYesDisk imagingYesMemory forensicsnot statedCase collaborationnot statedSupported platformsWindows, macOS, Linux 5/8spec lines stated 6.1
17 The Sleuth Kit Free plannot statedPaid fromnot statedEvidence sourcesRaw/dd, E01/EnCase, VHD, VMDK, AFF images; NTFS, FAT, ExFAT, APFS, UFS 1/2, EXT2/3/4, HFS, ISO 9660, and YAFFS2 file systemsMobile forensicsYesDisk imagingYesMemory forensicsnot statedCase collaborationnot statedSupported platformsLinux, Mac OS X, Windows, Cygwin, OpenBSD, FreeBSD, Solaris 4/8spec lines stated 6.0
18 Autopsy Free planYesPaid fromnot statedEvidence sourcesnot statedMobile forensicsnot statedDisk imagingnot statedMemory forensicsnot statedCase collaborationnot statedSupported platformsnot stated 1/8spec lines stated 5.9
19 OSForensics Free planNoPaid fromnot statedEvidence sourcesWindows, Mac, Linux, Android, iOS/macOS file systems, disk images, memory dumps, emails, browser data, registry hives, SQLite and ESE databasesMobile forensicsYesDisk imagingYesMemory forensicsYesCase collaborationnot statedSupported platformsWindows 7/8/10/11 and Windows Server 2012/2016/2019/2022 6/8spec lines stated 5.9
20 Oxygen Forensic Detective Free plannot statedPaid fromnot statedEvidence sourcesMobile devices; computers and external media; cloud services and app data; drones; vehicle systems; IoT sources; warrant returns; account data; third-party forensic extractionsMobile forensicsYesDisk imagingYesMemory forensicsnot statedCase collaborationYesSupported platformsWindows application; analyzes Windows, Linux, and macOS artifacts 5/8spec lines stated 5.9
21 MSAB XRY Free planNoPaid fromnot statedEvidence sourcesiOS devices; Android devices; smartphone apps; SIM cards; SD/memory cards; cloud storage; social-media services; iCloud backups; GPS devices; device RAM; full device dumps and binary filesMobile forensicsYesDisk imagingYesMemory forensicsYesCase collaborationNoSupported platformsWindows 7/8spec lines stated 5.8
22 Passware Kit Mobile Free planNoPaid fromnot statedEvidence sourcesLocked and encrypted Android and Apple mobile devices; iOS Keychain; 1Password; Dashlane; Second Space; Signal; Wickr; hardware-backed KeystoreMobile forensicsYesDisk imagingnot statedMemory forensicsnot statedCase collaborationnot statedSupported platformsWindows 10/11, Windows Server 2016-2025, macOS 10.14-26, and Linux recovery-agent computers 4/8spec lines stated 5.8
23 Timesketch Free plannot statedPaid fromnot statedEvidence sourcesPlaso storage files, CSV, JSON, JSONL, Pandas DataFrame, Python dict, XLS/XLSXMobile forensicsnot statedDisk imagingnot statedMemory forensicsnot statedCase collaborationYesSupported platformsLinux (Ubuntu 22.04), Docker 3/8spec lines stated 5.8
24 X-Ways Imager Free planNoPaid fromnot statedEvidence sourcesPhysical disks, SSDs, partitions, raw images, E01 images, disk-based RAID systemsMobile forensicsNoDisk imagingYesMemory forensicsYesCase collaborationNoSupported platformsWindows 7/8spec lines stated 5.8
25 ADF Triage-G2 Free planNoPaid fromnot statedEvidence sourcesiOS devices, Android devices, computers, USB devices, storage media, documents, emails, text communications, and digital imagesMobile forensicsYesDisk imagingYesMemory forensicsnot statedCase collaborationnot statedSupported platformsWindows, Mac, Linux, iOS, Android, and ChromeOS evidence environments 5/8spec lines stated 5.7
Compare all 25 in a table
| # | Tool | Score | Free plan | From | Free plan | Paid from | Evidence sources | Mobile forensics |
|---|---|---|---|---|---|---|---|---|
| 1 | Paraben E3 Forensic Platform | 7.7 | No | $58.25/mo | No | 699 /yr | Smartphones, computers, disk images, memory dumps, email, chat databases, cloud services, social media, IoT devices, game consoles, archives, and OSINT data | Yes |
| 2 | NetworkMiner | 7.2 | Free plan | Free | Yes | — | — | — |
| 3 | Cellebrite Inseyets | 7.1 | No | — | — | — | iOS devices; Android devices; mobile applications; cloud data; encrypted and containerized files; SIM cards; portable media; UAV evidence | Yes |
| 4 | Plaso | 7.1 | Free plan | Free | Yes | — | Storage-media images, files, directories, devices, logs, databases, Windows Registry data, Android and iOS artifacts | Yes |
| 5 | Volatility 3 | 7.0 | Free plan | Free | Yes | — | volatile memory (RAM) samples and memory images from Windows, Linux, and macOS | No |
| 6 | Arkime | 6.9 | Free plan | Free | Yes | — | — | — |
| 7 | Exterro FTK Imager | 6.9 | Free plan | $41.58/mo | Yes | — | Live enterprise endpoints; Windows, macOS, and selected Linux artifacts; Microsoft 365; Exchange; SharePoint; OneDrive; Google Workspace; Gmail; Google Drive; Slack; Microsoft Teams; Confluence; AFF4; E01; AD1; RAW/DD | No |
| 8 | Magnet AXIOM Cyber | 6.9 | No | — | No | — | Mobile devices; computer drives and forensic images; Windows, macOS, Linux, and Chromebook files and folders; Windows memory dumps; cloud services; remote endpoints | Yes |
| 9 | CAINE | 6.8 | Free plan | Free | Yes | — | raw/dd disk images; EnCase files; databases; internet histories; Windows registries; deleted files; EXIF data; volatile memory dumps; Android and iPod devices | Yes |
| 10 | SUMURI PALADIN | 6.8 | Free plan | Free | Yes | — | Disk images, local disks, logical files, unallocated-space images, Autopsy Logical Imager results, XRY text exports, mobile and vehicle data | Yes |
| 11 | Tsurugi Linux | 6.7 | Free plan | Free | Yes | — | disk images; volatile memory; mobile devices; file systems; OS artifacts; cloud environments; virtual machines; network data | Yes |
| 12 | SUMURI RECON LAB | 6.4 | No | — | No | — | macOS, Windows, Linux, iOS, Android, Google Takeout, AFF4 images, Cellebrite extractions, GrayKey backups, ADB Android backups | Yes |
| 13 | X-Ways Forensics | 6.3 | No | — | No | — | Raw DD images, ISO, VHD, VHDX, VDI, VMDK, physical disks, RAIDs, filesystems, Android/iOS data imported through third-party tools, iTunes backups | Yes |
| 14 | Hayabusa | 6.2 | No | — | — | — | Windows event logs (EVTX) | No |
| 15 | OpenText Forensic | 6.2 | No | — | — | — | Windows, macOS, Linux, mobile devices and backups, removable drives, encrypted volumes, Microsoft 365, Facebook, cloud storage, file systems | Yes |
| 16 | Elcomsoft Mobile Forensic Bundle | 6.1 | No | — | No | — | iOS devices, iOS backups, iCloud, Microsoft accounts, Google accounts, Windows devices, file-system images | Yes |
| 17 | The Sleuth Kit | 6.0 | No | — | — | — | Raw/dd, E01/EnCase, VHD, VMDK, AFF images; NTFS, FAT, ExFAT, APFS, UFS 1/2, EXT2/3/4, HFS, ISO 9660, and YAFFS2 file systems | Yes |
| 18 | Autopsy | 5.9 | No | — | Yes | — | — | — |
| 19 | OSForensics | 5.9 | No | — | No | — | Windows, Mac, Linux, Android, iOS/macOS file systems, disk images, memory dumps, emails, browser data, registry hives, SQLite and ESE databases | Yes |
| 20 | Oxygen Forensic Detective | 5.9 | No | — | — | — | Mobile devices; computers and external media; cloud services and app data; drones; vehicle systems; IoT sources; warrant returns; account data; third-party forensic extractions | Yes |
| 21 | MSAB XRY | 5.8 | No | — | No | — | iOS devices; Android devices; smartphone apps; SIM cards; SD/memory cards; cloud storage; social-media services; iCloud backups; GPS devices; device RAM; full device dumps and binary files | Yes |
| 22 | Passware Kit Mobile | 5.8 | No | — | No | — | Locked and encrypted Android and Apple mobile devices; iOS Keychain; 1Password; Dashlane; Second Space; Signal; Wickr; hardware-backed Keystore | Yes |
| 23 | Timesketch | 5.8 | No | — | — | — | Plaso storage files, CSV, JSON, JSONL, Pandas DataFrame, Python dict, XLS/XLSX | — |
| 24 | X-Ways Imager | 5.8 | No | — | No | — | Physical disks, SSDs, partitions, raw images, E01 images, disk-based RAID systems | No |
| 25 | ADF Triage-G2 | 5.7 | No | — | No | — | iOS devices, Android devices, computers, USB devices, storage media, documents, emails, text communications, and digital images | Yes |
Is your tool on this list?
Numbered spots on this list can be sponsored, and a sponsored row is labelled as paid.
Questions about this list
Which digital forensics software is ranked first on Specifiction?
Paraben E3 Forensic Platform is ranked #1 of 29 with a score of 7.7. NetworkMiner is second and Cellebrite Inseyets third.
How many of these have a free plan?
8 of the 25 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Exterro FTK Imager has the lowest first paid tier we found: $41.58/mo.
How is this list ranked?
Ranked on what each maker publishes, the fullest spec sheet first: how deeply the product is documented, the platforms it runs on, a free tier or trial to test it, and its standing.
More in IT & Infrastructure
All IT & infrastructure listsIT Asset Management Software 109Residential Proxy Services 73IT Automation Software 70IT Knowledge Base Software 61Website Monitoring Software 55IT SLA Management Software 50IT Help Desk Software 48Patch Management Software 46Identity and Access Management Software 43IT Change Management Software 43Application Deployment Software 42IT Problem Management Software 41