License & Deployment Mix: 13 tools – 8 OSS, 5 commercial (KAPE counted as proprietary even though it’s free for non-commercial use).
Color: Blue team.
What Is This Category?
Triage collection, host inspection, disk and memory forensics, and timeline reconstruction for active incidents and post-breach investigation.
DFIR is the practice of investigating what an attacker actually did once a compromise is suspected or confirmed. Where EDR is the always-on prevention / detection layer, DFIR tools are the investigator’s microscope: live response on hosts, disk and memory image analysis, timeline reconstruction across files, registry, event logs, browser history, and every other artefact the OS leaves behind.
Distinct from neighbouring categories
- EDR / XDR – EDR is the always-on telemetry stream and prevention; DFIR is the deep-dive that runs after EDR (or a SIEM alert, or a tip) says something happened
- SIEM & Log Analytics – SIEM correlates log events; DFIR rebuilds what happened on the host after the events
- SOAR – SOAR automates the response workflow; DFIR is what the playbook calls into for the deep collection
- Malware Analysis Sandbox – Sandbox detonates a sample to characterise the attacker’s tool; DFIR investigates what that tool did on a specific compromised host
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Overview
DFIR is a multi-tier discipline. A complete IR workflow needs collection (Velociraptor, GRR, KAPE), memory analysis (Volatility), disk analysis (Autopsy, EnCase, X-Ways), timeline (Plaso), case management (TheHive, DFIR-IRIS), and optionally sandbox (Hatching Triage). No single tool covers everything; a complete practice composes a stack from this list.
Capability Matrix
What each tool actually does.
| Tool | Live | Disk | Memory | Mobile | Cloud | Timeline | Case |
|---|---|---|---|---|---|---|---|
| Velociraptor | yes | yes | yes* | – | – | partial | – |
| KAPE | yes | yes | – | – | – | partial | – |
| Autopsy + Sleuth Kit | – | yes | – | partial | – | yes | partial |
| Volatility 3 | – | – | yes | partial | – | partial | – |
| GRR Rapid Response | yes | yes | yes | – | – | – | – |
| Plaso (log2timeline) | – | yes | – | – | – | yes | – |
| TheHive + Cortex | – | – | – | – | – | – | yes |
| DFIR-IRIS | – | – | – | – | – | – | yes |
| Magnet AXIOM | yes | yes | yes | yes | yes | yes | yes |
| Cellebrite Inseyets | – | – | – | yes | partial | – | yes |
| EnCase Forensic | yes** | yes | yes | partial | – | yes | yes |
| X-Ways Forensics | – | yes | partial | – | – | yes | – |
| Hatching Triage | – | – | – | – | – | – | – |
* Velociraptor captures memory via WinPmem / LiME but defers analysis to Volatility.
** EnCase Enterprise tier ships a Servlet agent for remote live response.
License Comparison
| Tool | License | OSI | Type |
|---|---|---|---|
| Velociraptor | AGPL-3.0-only | yes | OSS platform |
| KAPE | Proprietary | – | Free non-commercial / Kroll |
| Autopsy + Sleuth Kit | Apache-2.0 | yes | OSS desktop |
| Volatility 3 | Volatility Software License | yes | OSS CLI (BSD-derived) |
| GRR Rapid Response | Apache-2.0 | yes | OSS platform |
| Plaso (log2timeline) | Apache-2.0 | yes | OSS CLI |
| TheHive + Cortex | Proprietary (Cortex AGPL-3.0) | partial | Freemium web (TheHive 5); Cortex OSS |
| DFIR-IRIS | LGPL-3.0-only | yes | OSS web |
| Magnet AXIOM | Proprietary | – | Commercial desktop |
| Cellebrite Inseyets | Proprietary | – | Commercial desktop + appliance |
| EnCase Forensic | Proprietary | – | Commercial desktop |
| X-Ways Forensics | Proprietary | – | Commercial desktop |
| Hatching Triage | Proprietary | – | Commercial SaaS (Recorded Future) |
OS / Evidence-Type Coverage
| Tool | Win | Linux | macOS | iOS | Android | Cloud |
|---|---|---|---|---|---|---|
| Velociraptor | yes | yes | yes | – | – | – |
| KAPE | yes | partial | – | – | – | – |
| Autopsy + Sleuth Kit | yes | yes | yes | partial | partial | – |
| Volatility 3 | yes | yes | yes | – | yes | – |
| GRR Rapid Response | yes | yes | yes | – | – | – |
| Plaso (log2timeline) | yes | yes | yes | – | yes | partial |
| TheHive + Cortex | n/a | n/a | n/a | n/a | n/a | yes |
| DFIR-IRIS | n/a | n/a | n/a | n/a | n/a | yes |
| Magnet AXIOM | yes | yes | yes | yes | yes | yes |
| Cellebrite Inseyets | partial | – | partial | yes | yes | partial |
| EnCase Forensic | yes | partial | partial | partial | partial | – |
| X-Ways Forensics | yes | yes | partial | – | – | – |
| Hatching Triage | yes | yes | yes | – | yes | n/a |
SSO / OIDC
Desktop / CLI forensics tools have no native auth. Case-management and SaaS platforms do.
| Tool | OIDC | SAML | SCIM | Authentik Notes |
|---|---|---|---|---|
| Velociraptor | native | plugin | – | Native OIDC; Authentik direct |
| Desktop tools (KAPE, Autopsy, X-Ways, EnCase, Magnet, Cellebrite) | n/a | n/a | n/a | Local-user / floating licence |
| Memory / timeline CLIs (Volatility, Plaso) | n/a | n/a | n/a | CLI |
| GRR Rapid Response | plugin | plugin | – | Reverse-proxy auth (Authentik / IAP) |
| TheHive + Cortex | native | native | – | Native OIDC + SAML |
| DFIR-IRIS | plugin | plugin | – | Reverse-proxy or plugin |
| Hatching Triage | paid | paid | paid | Enterprise tier (Recorded Future) |
Deployment Comparison
| Tool | Deployment | Resources | Privileges |
|---|---|---|---|
| Velociraptor | Single Go binary; server + agents | Modest | Server: TLS port; Agents: per-host |
| KAPE | Single .NET binary | Trivial | Local on target |
| Autopsy + Sleuth Kit | Java desktop install | Workstation | Read on image |
| Volatility 3 | pip / Docker | Trivial | Read on memory dump |
| GRR Rapid Response | Docker Compose; server + agents | Heavy server | Per-host agents |
| Plaso (log2timeline) | pip / Docker | Modest | Read on image |
| TheHive + Cortex | Docker Compose (TheHive + Cortex + ES) | Medium | Web ports |
| DFIR-IRIS | Docker Compose | Modest | Web port |
| Magnet AXIOM | Windows desktop | Workstation | Read on evidence |
| Cellebrite Inseyets | Windows desktop + hardware | Workstation | Physical access to device |
| EnCase Forensic | Windows desktop + dongle | Workstation | Read on evidence |
| X-Ways Forensics | Single Windows executable | USB-stick portable | Read on evidence |
| Hatching Triage | SaaS | – | – |
Composition Patterns
Three canonical DFIR pipelines.
1. OSS-only IR stack
Velociraptor -- fleet-wide live response + triage Volatility -- memory analysis on collected dumps Autopsy -- disk analysis on imaged hosts Plaso -- super-timeline from collected artefacts TheHive + Cortex -- case management + automated enrichment MISP -- threat-intel pivots (see tools/threat-intel/)
Output: full IR coverage at zero license cost. A standard internal IR stack.
2. Customer engagement with commercial reach
Velociraptor (self-hosted) -- live response on customer hosts Magnet AXIOM -- disk + mobile + cloud forensics Volatility / Plaso -- memory + timeline analysis TheHive + Cortex -- case management
Output: commercial-grade evidence collection + OSS analysis. Standard pattern for engagements that require court-defensible mobile / cloud evidence.
3. Sandbox-first malware-triage workflow
SIEM alert -> Hatching Triage submission -> IOCs -> MISP MISP IOCs -> Velociraptor hunt across fleet Velociraptor finds infected hosts -> Volatility memory dump Volatility IOCs -> case in TheHive
Output: fast malware-triage feedback loop combining SaaS sandbox + OSS DFIR.
Cost Tier
Approximate cost for a DFIR practice with ~10 analysts / customers.
| Tier | Tooling | Approx Cost |
|---|---|---|
| Free | Velociraptor + Volatility + Autopsy + Plaso + DFIR-IRIS | $0 + operator time |
| Mid | Add X-Ways per-seat | $1,300 per analyst-seat |
| High | Add Magnet AXIOM | $5,000-15,000 per analyst-seat |
| Top | Add Cellebrite + EnCase | Enterprise contracts |
Tools
13 tools.
Autopsy + Sleuth Kit
Open-source disk forensics platform from Brian Carrier / Basis Technology; the canonical OSS disk-image analyser.
License: Apache-2.0 (OSS) · Kind: desktop · Deploy: native · SSO: none
Cellebrite Inseyets
Premium mobile-forensics platform; the law-enforcement reference for iOS / Android device extraction and analysis.
License: Proprietary (proprietary) · Kind: desktop · Deploy: native, appliance · SSO: OIDC, SAML
DFIR-IRIS
Open-source collaborative IR platform from DFIR-IRIS; case-tracking, evidence vault, report templating; lighter alternative to TheHive.
License: LGPL-3.0-only (OSS) · Kind: web · Deploy: docker, native · SSO: OIDC
EnCase Forensic
OpenText’s premium DFIR suite (formerly Guidance Software); the long-standing courtroom-reference tool for disk forensics.
License: Proprietary (proprietary) · Kind: desktop · Deploy: native · SSO: OIDC, SAML
GRR Rapid Response
Google’s open-source remote forensics framework; agent-based live response across Windows / Linux / macOS fleets.
License: Apache-2.0 (OSS) · Kind: web · Deploy: docker, native · SSO: none
Hatching Triage
SaaS malware-analysis sandbox with DFIR-friendly indicator extraction; acquired by Recorded Future in 2022 and integrated into the Intelligence Cloud.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
KAPE
Kroll Artifact Parser and Extractor; free-for-personal / commercial- for-business artefact triage collector from Eric Zimmerman / Kroll.
License: Proprietary (proprietary) · Kind: cli · Deploy: native · SSO: none
Magnet AXIOM
Premium commercial DFIR platform from Magnet Forensics; broad evidence-type coverage including mobile, cloud, IoT.
License: Proprietary (proprietary) · Kind: desktop · Deploy: native · SSO: OIDC, SAML
Plaso (log2timeline)
Open-source super-timeline tool (log2timeline successor); parses 100+ artefact types into one normalised timeline.
License: Apache-2.0 (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
TheHive + Cortex
Proprietary SOC case-management platform (TheHive 5, ex-AGPL). Pairs with Cortex (still AGPL-3.0) and MISP; the OSS IR community has moved to DFIR-IRIS.
License: Proprietary (proprietary) · Kind: web · Deploy: docker, native, saas · SSO: none
Velociraptor
Open-source endpoint visibility and DFIR platform; agent-based, query-driven (VQL), scales to tens of thousands of endpoints.
License: AGPL-3.0-only (OSS) · Kind: hybrid · Deploy: native, docker · SSO: OIDC
Volatility 3
Open-source memory-forensics framework from the Volatility Foundation; the canonical OSS memory-dump analysis tool.
License: Volatility Software License (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
X-Ways Forensics
Compact, fast Windows-native forensics platform from X-Ways Software (Germany); favoured for its speed and deep filesystem support.
License: Proprietary (proprietary) · Kind: desktop · Deploy: native · SSO: none
