Alternatives to Tsurugi Linux

ADF Triage-G2

Triage-G2 is intended for military and intelligence organizations conducting sensitive site exploitation and digital evidence work.

CAINE suits investigators and responders who need a Linux live environment with integrated forensic utilities.

Plaso suits digital forensic practitioners who need to collect and analyze events across files, devices, storage images, and logs.

Inseyets is intended for forensic examiners and investigators in law enforcement and private-sector teams.

NetworkMiner

NetworkMiner is for people investigating captured or live network traffic, including incident response teams, law enforcement, companies, and organizations.

Belkasoft X Forensic is intended for government customers, particularly digital forensic laboratories at federal law-enforcement agencies and state-level police departments.

Exterro FTK Imager

FTK Imager suits incident response and DFIR teams, law enforcement, forensic examiners, and corporate security or HR investigators working with supported evidence sources.

Paraben E3 Forensic Platform

It suits corporate, law-enforcement, government, and consulting investigators handling digital evidence across devices and services.

OSForensics

OSForensics suits investigators who need to collect, organize, and report on computer evidence.

Hayabusa suits security teams and analysts working with Windows event logs for timeline creation or threat hunting.

PALADIN suits law-enforcement, military, and corporate investigators needing Linux-based forensic imaging and recovery tools.

It suits forensic investigators and developers building tools for disk-image, volume, and file-system analysis.

Timesketch suits forensic teams needing shared, searchable timelines and case collaboration.

SIFT suits incident responders and forensic practitioners examining disk, network and memory evidence.

It suits investigators in law enforcement, the military, academia, and commercial settings who need to examine memory samples.