Best Digital Forensics Software in 2026
Updated
In short: NetworkMiner is ranked #1 of 29 as of 5 October 2026, ahead of Plaso and Volatility 3. The best-ranked option with a free plan is Plaso. The lowest first paid tier on this page is Exterro FTK Imager at $41.58/mo.
Digital forensics work can involve evidence from different sources, so compare the listed support and handling capabilities against your needs. NetworkMiner, Volatility 3, and Arkime are among the entries shown. Consider evidence sources and supported platforms, then compare disk imaging, memory forensics, and mobile forensics. Case collaboration and export formats add further details for assessing investigative workflows and how findings may be shared or produced. Free-plan availability and paid-from pricing provide cost context. The relevant combination depends on the evidence you need to examine, the platforms involved, and the listed ways to preserve, review, or export information.
29 digital forensics software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
8 of the 25 here have a free tier you can use, 0 have open-source code on record, and 0 have full bars: free, open, on most of your devices and documented.
| # | App | Signal | Free tier | Open code | Devices | From | Score |
|---|---|---|---|---|---|---|---|
| 1 | NetworkMinerWindows · Mac · Linux | Three bars | — | 3 of 6 | Free | 6.5 | |
| 2 | PlasoWindows · Mac · Linux · Self-hosted | Three bars | — | 3 of 6 | Free | 6.5 | |
| 3 | Volatility 3Windows · Mac · Linux · Self-hosted | Three bars | — | 3 of 6 | Free | 6.5 | |
| 4 | ArkimeWeb · Linux · Self-hosted · API | Two bars | — | 2 of 6 | Free | 6.4 | |
| 5 | CAINEWindows · Linux | Two bars | — | 2 of 6 | Free | 6.4 | |
| 6 | Exterro FTK ImagerWeb · Windows | Two bars | — | 2 of 6 | $41.58/mo | 6.4 | |
| 7 | SUMURI PALADINLinux | Two bars | — | 1 of 6 | Free | 6.4 | |
| 8 | Tsurugi LinuxLinux | Two bars | — | 1 of 6 | Free | 6.3 | |
| 9 | Paraben E3 Forensic PlatformWindows · Mac · Linux · Android · iPhone | Two bars | — | — | 5 of 6 | $58.25/mo | 5.8 |
| 10 | Cellebrite InseyetsWeb · Windows | One bar | — | — | 2 of 6 | — | 5.5 |
| 11 | HayabusaWindows · Mac · Linux | One bar | — | — | 3 of 6 | — | 5.4 |
| 12 | OpenText ForensicWindows · Mac · Linux | One bar | — | — | 3 of 6 | — | 5.4 |
| 13 | AutopsyWindows · Mac · Linux | One bar | — | — | 3 of 6 | — | 5.3 |
| 14 | The Sleuth KitWindows · Mac · Linux | One bar | — | — | 3 of 6 | — | 5.3 |
| 15 | GuymagerLinux | No signal | — | — | 1 of 6 | — | 5.2 |
| 16 | Oxygen Forensic DetectiveWindows | No signal | — | — | 1 of 6 | — | 5.2 |
| 17 | TimesketchWeb · Linux | No signal | — | — | 2 of 6 | — | 5.2 |
| 18 | Magnet AXIOM CyberWindows · Mac · Linux · Self-hosted | Two bars | — | — | 3 of 6 | — | 5.1 |
| 19 | SIFT WorkstationWindows · Linux | No signal | — | — | 2 of 6 | — | 5.1 |
| 20 | Elcomsoft Mobile Forensic BundleWindows · Mac · Linux | One bar | — | — | 3 of 6 | — | 5.0 |
| 21 | SUMURI RECON LABWindows · Mac | One bar | — | — | 2 of 6 | — | 5.0 |
| 22 | X-Ways ForensicsWindows · Self-hosted · API | One bar | — | — | 1 of 6 | — | 5.0 |
| 23 | OSForensicsWindows · Android | No signal | — | — | 2 of 6 | — | 4.9 |
| 24 | Passware Kit MobileWindows · Mac · Linux | One bar | — | — | 3 of 6 | — | 4.9 |
| 25 | ADF Triage-G2Windows | No signal | — | — | 1 of 6 | — | 4.8 |
Compare all 25 in a table
| # | App | Score | Free plan | From | Free plan | Paid from | Evidence sources | Mobile forensics |
|---|---|---|---|---|---|---|---|---|
| 1 | NetworkMiner | 6.5 | Free plan | Free | Yes | — | — | — |
| 2 | Plaso | 6.5 | Free plan | Free | Yes | — | Storage-media images, files, directories, devices, logs, databases, Windows Registry data, Android and iOS artifacts | Yes |
| 3 | Volatility 3 | 6.5 | Free plan | Free | Yes | — | volatile memory (RAM) samples and memory images from Windows, Linux, and macOS | No |
| 4 | Arkime | 6.4 | Free plan | Free | Yes | — | — | — |
| 5 | CAINE | 6.4 | Free plan | Free | Yes | — | raw/dd disk images; EnCase files; databases; internet histories; Windows registries; deleted files; EXIF data; volatile memory dumps; Android and iPod devices | Yes |
| 6 | Exterro FTK Imager | 6.4 | Free plan | $41.58/mo | Yes | — | Live enterprise endpoints; Windows, macOS, and selected Linux artifacts; Microsoft 365; Exchange; SharePoint; OneDrive; Google Workspace; Gmail; Google Drive; Slack; Microsoft Teams; Confluence; AFF4; E01; AD1; RAW/DD | No |
| 7 | SUMURI PALADIN | 6.4 | Free plan | Free | Yes | — | Disk images, local disks, logical files, unallocated-space images, Autopsy Logical Imager results, XRY text exports, mobile and vehicle data | Yes |
| 8 | Tsurugi Linux | 6.3 | Free plan | Free | Yes | — | disk images; volatile memory; mobile devices; file systems; OS artifacts; cloud environments; virtual machines; network data | Yes |
| 9 | Paraben E3 Forensic Platform | 5.8 | No | $58.25/mo | No | 699 /yr | Smartphones, computers, disk images, memory dumps, email, chat databases, cloud services, social media, IoT devices, game consoles, archives, and OSINT data | Yes |
| 10 | Cellebrite Inseyets | 5.5 | No | — | — | — | iOS devices; Android devices; mobile applications; cloud data; encrypted and containerized files; SIM cards; portable media; UAV evidence | Yes |
| 11 | Hayabusa | 5.4 | No | — | — | — | Windows event logs (EVTX) | No |
| 12 | OpenText Forensic | 5.4 | No | — | — | — | Windows, macOS, Linux, mobile devices and backups, removable drives, encrypted volumes, Microsoft 365, Facebook, cloud storage, file systems | Yes |
| 13 | Autopsy | 5.3 | No | — | Yes | — | — | — |
| 14 | The Sleuth Kit | 5.3 | No | — | — | — | Raw/dd, E01/EnCase, VHD, VMDK, AFF images; NTFS, FAT, ExFAT, APFS, UFS 1/2, EXT2/3/4, HFS, ISO 9660, and YAFFS2 file systems | Yes |
| 15 | Guymager | 5.2 | No | — | Yes | — | storage devices and removable media | — |
| 16 | Oxygen Forensic Detective | 5.2 | No | — | — | — | Mobile devices; computers and external media; cloud services and app data; drones; vehicle systems; IoT sources; warrant returns; account data; third-party forensic extractions | Yes |
| 17 | Timesketch | 5.2 | No | — | — | — | Plaso storage files, CSV, JSON, JSONL, Pandas DataFrame, Python dict, XLS/XLSX | — |
| 18 | Magnet AXIOM Cyber | 5.1 | No | — | No | — | Mobile devices; computer drives and forensic images; Windows, macOS, Linux, and Chromebook files and folders; Windows memory dumps; cloud services; remote endpoints | Yes |
| 19 | SIFT Workstation | 5.1 | No | — | Yes | — | — | — |
| 20 | Elcomsoft Mobile Forensic Bundle | 5.0 | No | — | No | — | iOS devices, iOS backups, iCloud, Microsoft accounts, Google accounts, Windows devices, file-system images | Yes |
| 21 | SUMURI RECON LAB | 5.0 | No | — | No | — | macOS, Windows, Linux, iOS, Android, Google Takeout, AFF4 images, Cellebrite extractions, GrayKey backups, ADB Android backups | Yes |
| 22 | X-Ways Forensics | 5.0 | No | — | No | — | Raw DD images, ISO, VHD, VHDX, VDI, VMDK, physical disks, RAIDs, filesystems, Android/iOS data imported through third-party tools, iTunes backups | Yes |
| 23 | OSForensics | 4.9 | No | — | No | — | Windows, Mac, Linux, Android, iOS/macOS file systems, disk images, memory dumps, emails, browser data, registry hives, SQLite and ESE databases | Yes |
| 24 | Passware Kit Mobile | 4.9 | No | — | No | — | Locked and encrypted Android and Apple mobile devices; iOS Keychain; 1Password; Dashlane; Second Space; Signal; Wickr; hardware-backed Keystore | Yes |
| 25 | ADF Triage-G2 | 4.8 | No | — | No | — | iOS devices, Android devices, computers, USB devices, storage media, documents, emails, text communications, and digital images | Yes |
Is your app on this list?
Numbered spots on this list can be sponsored, and a sponsored row is labelled as paid.
Questions about this list
Which digital forensics software is ranked first on Freedom251?
NetworkMiner is ranked #1 of 29 with a score of 6.5. Plaso is second and Volatility 3 third.
How many of these have a free plan?
8 of the 25 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Exterro FTK Imager has the lowest first paid tier we found: $41.58/mo.
How is this list ranked?
Ranked free-and-open first: a usable free tier and open-source code, then the platforms it runs on and its documentation.