Recommended Free Tools
Investigate an incident by preserving the record as it unfolds, building a timestamped timeline, and separating observed facts from explanations. During an active incident, prioritize reducing user impact; test possible causes after the situation is under control. A blameless postmortem can then turn the evidence into owned, trackable improvements.
Why memory alone is a weak incident record
People remember incidents through the pressure and uncertainty of the moment. Later knowledge of the outcome can also make an explanation seem obvious when it was not obvious to responders at the time. A working record reduces reliance on memory and preserves information needed to reconstruct events. Google’s incident-response guidance recommends keeping such a record during response.
As an Amazon Associate I earn from qualifying purchases.
Capture observations with their source and time where possible: alerts, user reports, relevant logs, deployments or configuration changes, decisions, escalations, and actions taken. Label what is directly observed and what is an interpretation. For example, “latency rose after the deployment” records a sequence; “the deployment caused the latency” is a causal claim that needs supporting evidence.
What to record while the incident is active
Keep a live working document
Record debugging and mitigation activity as it happens, including communications and evidence that may be useful later. If a timestamp is approximate, identify it as approximate; if it is unknown, leave it unknown rather than presenting a guess as fact. Google’s incident anatomy guidance describes a live document as a way to retain the sequence and details needed for later analysis.
#1 Best Overall
- TX2 Forensic Imager Kit Includes: TX2 Forensic Imager, TP8 Power Supply, US Power Cord, (x4) TC4-8-R4 Unified SATA/SAS Signal and Power Cable (Molex), (x2) TC-PCIE4-8 PCIe Adapter Cable, 8", (x2) TCA-USB3-AC USB 3.0-A to USB 3.1-C Cable Adapter, Velcro Cable Ties (TPKG-VCT-5), Microfiber Cloth (TPKG-CLOTH), Quick Ref Guide
- LIGHTNING-FAST PROCESSING AND IMAGING: Powered by parallel hash verification and concurrent imaging, the TX2 is up to 3.8x faster than its predecessor. Capture and verify evidence in record time across multiple jobs.
- STREAMLINED RECONFIGURATION PROCESS: The TX2 makes it easy to pivot between tasks with a simplified reconfiguration process. Wipe, format, or encrypt all in one.
- UNLIMITED CONCURRENT OR CONSECUTIVE QUEUEING: The TX2's architecture is built for multitasking, allowing for unlimited concurrent or consecutive queueing. Stack jobs back-to-back or run several at once.
- OPTIMAL POWER ALLOCATION: The TX2 intelligently allocates power with dynamic resource assessment to maintain peak performance during heavy workloads. Its dynamic power management evaluates task demands in real time, ensuring every imaging job runs at optimal speed.
Make coordination and priorities clear
Use clear response roles and a line of command so participants know who is coordinating, communicating, and taking action. Declare incidents early when warranted. Assess impact and mitigate first; a complete causal explanation is not a prerequisite for steps that reduce ongoing harm. Google’s incident management guide and response guidance describe this emphasis on coordinated response and mitigation before post-incident analysis.
How to build a defensible timeline
Reconstruct the sequence from the working record and other contemporaneous evidence. Give each timestamp a clear meaning: an issue’s start, detection, escalation, mitigation, resolution, or another specific event. Start and detection are not necessarily the same time. Include impact and the evidence supporting each entry, and label estimates or unknowns honestly.
Rank #2
- The PBN-TEC Digital Investigation Kit is a comprehensive eight-tool investigation system trusted by law enforcement agencies, private investigators, IT security professionals, legal teams, and even concerned parents. One kit covers mobile device extraction, computer investigations, evidence collection, illicit content detection, audio monitoring, and secure file deletion — no additional software purchases required.
- The iRecovery Stick extracts and investigates data from iPhone and iPad devices, the Phone Recovery Stick handles Android phones and tablets, and the SIM Card Seizure analyzes data from virtually any GSM SIM card. Together these three tools provide complete mobile device investigation coverage from a single kit, including contacts, messages, call logs, and photos.
- The Data Recovery Stick recovers deleted files from any Windows OS, the Voice Logger installs an audio monitoring application onto any Windows computer, and the Data Shredder Stick securely deletes files and wipes storage when the investigation is complete. All three tools work on Windows XP or newer with no additional software required.
- The Capturra Action Drive 1TB automatically collects targeted file types from virtually any device, serving as both an evidence storage drive and a targeted file collection tool for focused investigations. The XXX Detection Stick then scans the collected evidence for illicit content, categorizing results into Low Suspect, Suspect, and Highly Suspect for review.
- The Digital Investigation Kit includes everything needed to begin an investigation immediately — a Data Cable Kit with iPhone, USB-C, and Micro USB cables, a universal SIM Card Adapter compatible with all SIM card sizes, and a Softshell Compartmentalized Protection Case to organize and transport all eight tools securely.
- Issue began: Record the earliest supported indication that the service or user experience was affected. If the start cannot be established, mark it unknown or provide a qualified interval rather than inventing a precise time.
- Detected: Note when an alert, user report, or other signal brought the issue to attention, and identify the signal’s source.
- Escalated: Record when responders were engaged or coordination changed, with the relevant decision or communication.
- Mitigation: Note what action was taken and when, then record the observed result without assuming more than the evidence shows.
- Impact and resolution: Describe the affected users or service and the evidence for the impact window; record when the incident was considered resolved and on what basis.
Google’s incident timeline guidance supports making these event types legible. When records conflict or leave gaps, preserve the discrepancy instead of smoothing it into a confident narrative.
How to test explanations after impact is controlled
Use the timeline to check competing explanations against the observations. Ask what evidence supports each explanation, what evidence would be expected if it were true, and whether another explanation fits the same sequence. A correlation can help identify where to investigate, but it does not establish cause by itself. If available evidence cannot answer a question, state that limitation.
Rank #3
- Backlit Interface - Device status, device information, logical unit (LUN) select, and bridge information are easily accessible
- Supports USB 1.0/2.0/3.0, Flash Drives, Mass Storage Drives, and any "bulk storage" drive
- Kit Includes - TP2 Power Supply with US-Style power cord, TC-USB3 USB 3.0 (A to B) cable, 6 foot length, Soft-Sided bag and Quick Start Guide
- Hardware-Based USB 3.0 Write Blocker
Google Cloud describes a postmortem as a record of the incident, its impact, actions taken, causes, and follow-up. Its postmortem workflow moves from creating the record and capturing facts to analyzing causes, planning improvements, and executing that plan.
How to write a blameless postmortem
Describe the conditions responders faced and the information available when decisions were made. Avoid judging a choice as obvious only because the eventual explanation is now known. Blameless analysis is not the absence of accountability for improving a system; it shifts attention from indicting a person or team to understanding contributing conditions. Google SRE’s postmortem culture guidance recommends this approach and assuming responders acted with good intentions and the information available to them.
Rank #4
- The Cellphone Investigation Kit is a complete solution for accessing and preserving data from virtually any mobile device. One kit covers iPhones, Android phones, GSM SIM cards, and photo backup — giving investigators, IT professionals, and parents everything they need in a single package.
- The included iRecovery Stick accesses data directly from iPhones and iPads running up to iOS 26.x, pulling contacts, text messages, call logs, saved passwords, WiFi networks, photos, the Deleted Photos folder, and more. Runs entirely on your Windows PC — no software is installed on the target device and no trace is left behind.
- The Phone Recovery Stick analyzes Android devices, recovering contacts, messages, photos, call logs, and more from a wide range of Android smartphones and tablets. Connect the target Android device to your Windows PC alongside the stick to begin extraction and data analysis.
- The SIM Card Seizure reader pulls data stored directly on GSM SIM cards, including contacts, SMS messages, call history, carrier information, and SIM serial numbers. Compatible with SIM cards from any carrier — including older flip phones and prepaid devices — making it essential for cases involving old phones that store data on SIM cards.
- The Photo Backup Stick completes the kit with fast photo and video backup from phones, tablets, and even computers, preserving visual evidence without requiring a PC or special software. All four tools work together to give you comprehensive mobile device coverage from a single professional investigation kit.
Agree in advance which incidents require a postmortem. Google SRE gives examples including user-visible downtime or degradation, data loss, on-call intervention, unusually long resolution, and monitoring failure. The purpose is to learn consistently from incidents that meet the team’s chosen criteria, not only from cases with a confirmed single cause.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTurn findings into improvements that get completed
For each follow-up, connect the proposed change to a finding, name an owner, set a deadline, and track it through completion. Consider whether improvements are needed in prevention, detection, mitigation, coordination, or communication—not only in the code or configuration directly involved in the incident. Google’s incident management guide and incident anatomy guidance frame post-incident work as a way to improve both systems and response.
Best Value
For cybersecurity incidents, use the current NIST guidance
For cybersecurity response, NIST’s SP 800-61 Revision 3 was finalized in April 2025 and superseded Revision 2. NIST describes the current revision as integrating incident response into cybersecurity risk management; consult its incident response project page for the current publication information. The incident-reconstruction practices above are useful framing, but they do not replace applicable security procedures, reporting obligations, or evidence-handling requirements.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
