Arkime vs OSForensics

Arkime is a free, open-source network analysis and session search tool that passively observes traffic and creates searchable session records. It parses layers 3–7 and indexes fields including protocols, DNS names, HTTP headers, TLS/JA4 fingerprints, file hashes, and GeoIP in OpenSearch or Elasticsearch. Operators can store full packets in standard PCAP format or use metadata-only capture, with rules to select traffic for saving. Users can search sessions, inspect packet data, and export results as PCAP or CSV. Cont3xt enriches supported indicators using commercial and OSINT sources, including VirusTotal, Censys, and Shodan; phone enrichment is limited to the U.S. Parliament groups clusters and displays cluster issues and Elasticsearch health. Capture can scale by adding machines or increasing CPU and disk. Arkime has no license fees or paid-only features. Installation guidance covers Linux, recommends Debian or Ubuntu LTS, and links to a container guide. OpenSearch or Elasticsearch is required for session metadata. Authentication options include basic, form, digest, header, and OIDC, while the project advises against anonymous authentication.

OSForensics is digital investigation software for extracting and examining forensic data from computers. It searches and indexes files, looks inside documents and email archives, and attempts to recover deleted files. Hashing can verify evidence or compare it with known files, while extension checks can flag files whose extensions are incorrect. The software can surface recent activity such as opened documents, web history, connected USB devices, and network shares. Password tools target commonly used web browsers and can use rainbow tables to retrieve passwords from hashes. Investigators can group evidence into case files, cryptographically hash data, and export reports readable as HTML or PDF, with narratives and external reports. It can maintain a secure audit trail and create or restore disk images for analysis. OSForensics can also run from a portable USB drive. Listed evidence sources include Windows, Mac, Linux, Android, and iOS/macOS file systems, plus disk images, memory dumps, email, browser data, registry hives, SQLite, and ESE databases. Windows 7, 8, 10, and 11 are listed, as are several Windows Server versions. A free license and a 30-day trial are listed; subscription pricing is $95 per user per month.