Here are some of the computer forensic investigator tools you would need.

As such, they all provide the ability to bring back in-depth information about whats under the hood of a system.

It supports TrueCrypt, PGP, Bitlocker, Safeboot encrypted volumes.

Wireshark will be handy to investigate network related incident.

Network Miner provide extracted artifacts in an intuitive user interface.

NMAP is supported on most of the operating systems including Windows, Linux, Solaris, MAC OS, HP-UX etc.

Memory dumps may contain encrypted volumes password and login credentials for webmails and social network services.

USB Write Blocker use Windows registry to write-block USB devices.

You can view the results in XML, CSV, TSV or HTML with help of CRConvert.

It can read EXIF, GPS, IPTC, XMP, JFIF, GeoTIFF, Photoshop IRB, FlashPix, etc.

With this tool, you can extract information from running processes, network sockets, network connection, DLLs and registry hives.

It also has support for extracting information from Windows crash dump files and hibernation files.

It provides the capability of analyzing the Windows kernel, drivers, DLLs, virtual and physical memory.

It runs under several Unix-related operating systems.

It can be used to aid analysis of computer disasters and data recovery.

It scans the disk images, file or directory of files to extract useful information.

In this process, it ignores the file system structure, so it is faster than other available similar kinds of tools.

It is basically used by intelligence and law enforcement agencies in solving cyber crimes.

While a lot of the additional features are found in the commercial versions of Hex Editor Neo, I find this tool useful for loading large files (e.g.

Encase Forensic Programs Password And Login

Free Encase Forensic Crack Programs