Color: Blue team.
What Is This Category?
Mix (13 tools)
- License: 6 open source · 7 proprietary
- Hosting: 11 self-hosted · 1 SaaS · 1 both
Triage collection, host inspection, disk and memory forensics, and timeline reconstruction for active incidents and post-breach investigation.
DFIR is the practice of investigating what an attacker actually did once a compromise is suspected or confirmed. Where EDR is the always-on prevention / detection layer, DFIR tools are the investigator’s microscope: live response on hosts, disk and memory image analysis, timeline reconstruction across files, registry, event logs, browser history, and every other artefact the OS leaves behind.
Distinct from neighbouring categories
- EDR / XDR – EDR is the always-on telemetry stream and prevention; DFIR is the deep-dive that runs after EDR (or a SIEM alert, or a tip) says something happened
- SIEM & Log Analytics – SIEM correlates log events; DFIR rebuilds what happened on the host after the events
- SOAR – SOAR automates the response workflow; DFIR is what the playbook calls into for the deep collection
- Malware Analysis Sandbox – Sandbox detonates a sample to characterise the attacker’s tool; DFIR investigates what that tool did on a specific compromised host
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
Overview
DFIR is a multi-tier discipline. A complete IR workflow needs collection (Velociraptor, GRR, KAPE), memory analysis (Volatility), disk analysis (Autopsy, EnCase, X-Ways), timeline (Plaso), case management (TheHive, DFIR-IRIS), and optionally sandbox (Hatching Triage). No single tool covers everything; a complete practice composes a stack from this list.
Capability Matrix
What each tool actually does.
| Tool | Live | Disk | Memory | Mobile | Cloud | Timeline | Case |
|---|---|---|---|---|---|---|---|
| Velociraptor | yes | yes | yes* | – | – | partial | – |
| KAPE | yes | yes | – | – | – | partial | – |
| Autopsy + Sleuth Kit | – | yes | – | partial | – | yes | partial |
| Volatility 3 | – | – | yes | partial | – | partial | – |
| GRR Rapid Response | yes | yes | yes | – | – | – | – |
| Plaso (log2timeline) | – | yes | – | – | – | yes | – |
| TheHive + Cortex | – | – | – | – | – | – | yes |
| DFIR-IRIS | – | – | – | – | – | – | yes |
| Magnet AXIOM | yes | yes | yes | yes | yes | yes | yes |
| Cellebrite Inseyets | – | – | – | yes | partial | – | yes |
| EnCase Forensic | yes** | yes | yes | partial | – | yes | yes |
| X-Ways Forensics | – | yes | partial | – | – | yes | – |
| Hatching Triage | – | – | – | – | – | – | – |
* Velociraptor captures memory via WinPmem / LiME but defers analysis to Volatility.
** EnCase Enterprise tier ships a Servlet agent for remote live response.
License Comparison
| Tool | License | OSI | Type |
|---|---|---|---|
| Velociraptor | AGPL-3.0-only | yes | OSS platform |
| KAPE | Proprietary | – | Free non-commercial / Kroll |
| Autopsy + Sleuth Kit | Apache-2.0 | yes | OSS desktop |
| Volatility 3 | Volatility Software License | yes | OSS CLI (BSD-derived) |
| GRR Rapid Response | Apache-2.0 | yes | OSS platform |
| Plaso (log2timeline) | Apache-2.0 | yes | OSS CLI |
| TheHive + Cortex | Proprietary (Cortex AGPL-3.0) | partial | Freemium web (TheHive 5); Cortex OSS |
| DFIR-IRIS | LGPL-3.0-only | yes | OSS web |
| Magnet AXIOM | Proprietary | – | Commercial desktop |
| Cellebrite Inseyets | Proprietary | – | Commercial desktop + appliance |
| EnCase Forensic | Proprietary | – | Commercial desktop |
| X-Ways Forensics | Proprietary | – | Commercial desktop |
| Hatching Triage | Proprietary | – | Commercial SaaS (Recorded Future) |
OS / Evidence-Type Coverage
| Tool | Win | Linux | macOS | iOS | Android | Cloud |
|---|---|---|---|---|---|---|
| Velociraptor | yes | yes | yes | – | – | – |
| KAPE | yes | partial | – | – | – | – |
| Autopsy + Sleuth Kit | yes | yes | yes | partial | partial | – |
| Volatility 3 | yes | yes | yes | – | yes | – |
| GRR Rapid Response | yes | yes | yes | – | – | – |
| Plaso (log2timeline) | yes | yes | yes | – | yes | partial |
| TheHive + Cortex | n/a | n/a | n/a | n/a | n/a | yes |
| DFIR-IRIS | n/a | n/a | n/a | n/a | n/a | yes |
| Magnet AXIOM | yes | yes | yes | yes | yes | yes |
| Cellebrite Inseyets | partial | – | partial | yes | yes | partial |
| EnCase Forensic | yes | partial | partial | partial | partial | – |
| X-Ways Forensics | yes | yes | partial | – | – | – |
| Hatching Triage | yes | yes | yes | – | yes | n/a |
SSO / OIDC
Desktop / CLI forensics tools have no native auth. Case-management and SaaS platforms do.
| Tool | OIDC | SAML | SCIM | Authentik Notes |
|---|---|---|---|---|
| Velociraptor | native | plugin | – | Native OIDC; Authentik direct |
| Desktop tools (KAPE, Autopsy, X-Ways, EnCase, Magnet, Cellebrite) | n/a | n/a | n/a | Local-user / floating licence |
| Memory / timeline CLIs (Volatility, Plaso) | n/a | n/a | n/a | CLI |
| GRR Rapid Response | plugin | plugin | – | Reverse-proxy auth (Authentik / IAP) |
| TheHive + Cortex | native | native | – | Native OIDC + SAML |
| DFIR-IRIS | plugin | plugin | – | Reverse-proxy or plugin |
| Hatching Triage | paid | paid | paid | Enterprise tier (Recorded Future) |
Deployment Comparison
| Tool | Deployment | Resources | Privileges |
|---|---|---|---|
| Velociraptor | Single Go binary; server + agents | Modest | Server: TLS port; Agents: per-host |
| KAPE | Single .NET binary | Trivial | Local on target |
| Autopsy + Sleuth Kit | Java desktop install | Workstation | Read on image |
| Volatility 3 | pip / Docker | Trivial | Read on memory dump |
| GRR Rapid Response | Docker Compose; server + agents | Heavy server | Per-host agents |
| Plaso (log2timeline) | pip / Docker | Modest | Read on image |
| TheHive + Cortex | Docker Compose (TheHive + Cortex + ES) | Medium | Web ports |
| DFIR-IRIS | Docker Compose | Modest | Web port |
| Magnet AXIOM | Windows desktop | Workstation | Read on evidence |
| Cellebrite Inseyets | Windows desktop + hardware | Workstation | Physical access to device |
| EnCase Forensic | Windows desktop + dongle | Workstation | Read on evidence |
| X-Ways Forensics | Single Windows executable | USB-stick portable | Read on evidence |
| Hatching Triage | SaaS | – | – |
Composition Patterns
Three canonical DFIR pipelines.
1. OSS-only IR stack
Velociraptor -- fleet-wide live response + triage Volatility -- memory analysis on collected dumps Autopsy -- disk analysis on imaged hosts Plaso -- super-timeline from collected artefacts TheHive + Cortex -- case management + automated enrichment MISP -- threat-intel pivots (see tools/threat-intel/)
Output: full IR coverage at zero license cost. A standard internal IR stack.
2. Customer engagement with commercial reach
Velociraptor (self-hosted) -- live response on customer hosts Magnet AXIOM -- disk + mobile + cloud forensics Volatility / Plaso -- memory + timeline analysis TheHive + Cortex -- case management
Output: commercial-grade evidence collection + OSS analysis. Standard pattern for engagements that require court-defensible mobile / cloud evidence.
3. Sandbox-first malware-triage workflow
SIEM alert -> Hatching Triage submission -> IOCs -> MISP MISP IOCs -> Velociraptor hunt across fleet Velociraptor finds infected hosts -> Volatility memory dump Volatility IOCs -> case in TheHive
Output: fast malware-triage feedback loop combining SaaS sandbox + OSS DFIR.
Cost Tier
Approximate cost for a DFIR practice with ~10 analysts / customers.
| Tier | Tooling | Approx Cost |
|---|---|---|
| Free | Velociraptor + Volatility + Autopsy + Plaso + DFIR-IRIS | $0 + operator time |
| Mid | Add X-Ways per-seat | $1,300 per analyst-seat |
| High | Add Magnet AXIOM | $5,000-15,000 per analyst-seat |
| Top | Add Cellebrite + EnCase | Enterprise contracts |
Tools
13 tools.
Autopsy + Sleuth Kit
Open-source disk forensics platform from Brian Carrier / Basis Technology; the canonical OSS disk-image analyser.
License: Apache-2.0 (OSS) · Kind: desktop · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
Cellebrite Inseyets
Premium mobile-forensics platform; the law-enforcement reference for iOS / Android device extraction and analysis.
License: Proprietary (proprietary) · Kind: desktop · Deploy: direct, appliance · SSO: OIDC, SAML
ResorsIT usage: Deployment Payload
Access & Identity: Single sign-on · Local host account · Key-based access
DFIR-IRIS
Open-source collaborative IR platform from DFIR-IRIS; case-tracking, evidence vault, report templating; lighter alternative to TheHive.
License: LGPL-3.0-only (OSS) · Kind: web · Deploy: docker, direct · SSO: OIDC
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
EnCase Forensic
OpenText’s premium DFIR suite (formerly Guidance Software); the long-standing courtroom-reference tool for disk forensics.
License: Proprietary (proprietary) · Kind: desktop · Deploy: direct · SSO: OIDC, SAML
ResorsIT usage: Deployment Payload
Access & Identity: Single sign-on · Local host account
GRR Rapid Response
Google’s open-source remote forensics framework; agent-based live response across Windows / Linux / macOS fleets.
License: Apache-2.0 (OSS) · Kind: web · Deploy: docker, direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Hatching Triage
SaaS malware-analysis sandbox with DFIR-friendly indicator extraction; acquired by Recorded Future in 2022 and integrated into the Intelligence Cloud.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
KAPE
Kroll Artifact Parser and Extractor; free-for-personal / commercial- for-business artefact triage collector from Eric Zimmerman / Kroll.
License: Proprietary (proprietary) · Kind: cli · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
Magnet AXIOM
Premium commercial DFIR platform from Magnet Forensics; broad evidence-type coverage including mobile, cloud, IoT.
License: Proprietary (proprietary) · Kind: desktop · Deploy: direct · SSO: OIDC, SAML
ResorsIT usage: Deployment Payload
Access & Identity: Single sign-on · Local host account
Plaso (log2timeline)
Open-source super-timeline tool (log2timeline successor); parses 100+ artefact types into one normalised timeline.
License: Apache-2.0 (OSS) · Kind: cli · Deploy: direct, docker, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
TheHive + Cortex
Proprietary SOC case-management platform (TheHive 5, ex-AGPL). Pairs with Cortex (still AGPL-3.0) and MISP; the OSS IR community has moved to DFIR-IRIS.
License: Proprietary (proprietary) · Kind: web · Deploy: docker, direct, saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Directory / LDAP
Velociraptor
Open-source endpoint visibility and DFIR platform; agent-based, query-driven (VQL), scales to tens of thousands of endpoints.
License: AGPL-3.0-only (OSS) · Kind: hybrid · Deploy: direct, docker · SSO: OIDC
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
Volatility 3
Open-source memory-forensics framework from the Volatility Foundation; the canonical OSS memory-dump analysis tool.
License: Volatility Software License (OSS) · Kind: cli · Deploy: direct, docker, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
X-Ways Forensics
Compact, fast Windows-native forensics platform from X-Ways Software (Germany); favoured for its speed and deep filesystem support.
License: Proprietary (proprietary) · Kind: desktop · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
