forensics-all for Debian
------------------------

LIST OF PACKAGES INSTALLED BY forensics-all


COMMON PACKAGES (available for all machines)

aesfix - tool for correcting bit errors in an AES key schedule
afflib-tools - Advanced Forensics Format Library (utilities)
altdns - Subdomain discovery through alterations and permutations
argon2 - memory-hard hashing function - utility
assetfinder - Find domains and subdomains related to a given domain
braa - Mass SNMP scanner
bruteforce-salted-openssl - try to find the passphrase for files encrypted with OpenSSL
bruteforce-wallet - try to find the password of an encrypted wallet file
btscanner - ncurses-based scanner for Bluetooth devices
capstone-tool - lightweight multi-architecture disassembly framework - command line tool
ccrypt - secure encryption and decryption of files and streams
cewl - custom word list generator
chaosreader - trace network sessions and export it to html format
creddump7 - Python tool to extract credentials and secrets from Windows registry hives
dirb - URL bruteforcing tool
dislocker - read/write encrypted BitLocker volumes
dnsrecon - Powerful DNS enumeration script
doona - Network fuzzer forked from bed
ed2k-hash - tool for generating ed2k-links
ext4magic - recover deleted files from ext3 or ext4 partitions
extundelete - utility to recover deleted files from ext3/ext4 partition
ewf-tools - collection of tools for reading and writing EWF files
fatcat - FAT filesystem explore, extract, repair, and forensic tool
fcrackzip - password cracker for zip archives
forensic-artifacts - knowledge base of forensic artifacts (data files)
forensics-colorize - show differences between files using color graphics
galleta - Internet Explorer cookie forensic analysis tool
gpshell - GlobalPlatform Shell smart card script interpreter
graudit - grep rough audit - source code auditing tool
grokevt - scripts for reading Microsoft Windows event log files
hashdeep - recursively compute hashsums or piecewise hashings
hashid - Identify the different types of hashes used to encrypt data
hashrat - hashing tool supporting several hashes and recursivity
hcxkeys - Tools to generate plainmasterkeys (rainbowtables)
hcxtools - Tools for converting captures to use with hashcat or John the Ripper
john - active password cracking tool
mac-robber - collects data about allocated files in mounted filesystems
maskprocessor - high-performance word generator with a per-position configurable charset
masscan - TCP port scanner
memdump - utility to dump memory contents to standard output
metacam - extract EXIF information from digital camera files
missidentify - find win32 applications
myrescue - rescue data from damaged disks
nasty - tool which helps you to recover your GPG passphrase
nbtscan - scan networks searching for NetBIOS information
ncrack - High-speed network authentication cracking tool
ngrep - grep for network traffic
ophcrack-cli - Microsoft Windows password cracker using rainbow tables (cmdline)
pasco - Internet Explorer cache forensic analysis tool
pff-tools - utilities for MS Outlook PAB, PST and OST files
pipebench - measure the speed of stdin/stdout communication
pixiewps - Offline WPS bruteforce tool
pnscan - Multi threaded port scanner
polenum - Extracts the password policy from a Windows system
pompem - Exploit and Vulnerability Finder
readpe - command-line tools to manipulate Windows PE files
recoverdm - recover files on disks with damaged sectors
recoverjpeg - recover JFIF (JPEG) pictures and MOV movies
regripper - perform forensic analysis of registry hives
rephrase - Specialized passphrase recovery tool for GnuPG
rhash - utility for computing hash sums and magnet links
rifiuti - MS Windows recycle bin analysis tool
rifiuti2 - replacement for rifiuti, a MS Windows recycle bin analysis tool
rkhunter - rootkit, backdoor, sniffer and exploit scanner
rsakeyfind - locates BER-encoded RSA private keys in memory images
safecopy - data recovery tool for problematic or damaged media
samdump2 - Dump Windows 2k/NT/XP password hashes
scrounge-ntfs - Data recovery program for NTFS filesystems
shed - simple hex editor with a pico-style interface
sherlock - Find usernames across social networks
sleuthkit - tools for forensics analysis on volume and filesystem data
smbmap - handy SMB enumeration tool
snowdrop - plain text watermarking and watermark recovery
sploitscan - Search for CVE information
ssdeep - recursive piecewise hashing tool
ssldump - SSLv3/TLS network protocol analyzer
statsprocessor - word generator based on per-position Markov chains
stegsnow - steganography using ASCII files
sucrack - multithreaded su bruteforcer
tableau-parm - tableau write-blocking bridge query/command utility
tcpdump - command-line network traffic analyzer
testssl.sh - Command line tool to check TLS/SSL ciphers, protocols and cryptographic flaws
undbx - tool to extract, recover and undelete e-mail messages from .dbx files
unhide - forensic tool to find hidden processes and ports
unhide.rb - Forensics tool to find processes hidden by rootkits
usbrip - USB device artifacts tracker
vinetto - forensics tool to examine Thumbs.db files
waymore - Tool to discover extensive data from online archives
wfuzz - Web application bruteforcer
winregfs - Windows registry FUSE filesystem
wipe - secure file deletion
yara - Pattern matching swiss knife for malware researchers

RECOMMENDED PACKAGES (available for some architectures only)

acct - GNU Accounting utilities for process and login accounting
aeskeyfind - tool for locating AES keys in a captured memory image
aircrack-ng - wireless WEP/WPA cracking utilities
bruteforce-luks - Try to find a password of a LUKS encrypted volume
brutespray - Python bruteforce tool
bully - Implementation of the WPS brute force attack, written in C
chkrootkit - rootkit detector
cisco7crack - Crypt and decrypt the cisco type 7 passwords
cowpatty - Brute-force WPA dictionary attack
dc3dd - patched version of GNU dd with forensic features
dsniff - Various tools to sniff network traffic for cleartext insecurities
exiflooter - finds geolocation on all image urls and directories
exifprobe - read metadata from digital pictures
ext3grep - tool to help recover deleted files on ext3 filesystems
gpart - Guess PC disk partition table, find lost partitions
hashcat - World's fastest and most advanced password recovery utility
hydra - very fast network logon cracker
ike-scan - discover and fingerprint IKE hosts (IPsec VPN Servers)
magicrescue - recover files by looking for magic bytes
mdk3 - Wireless attack tool for IEEE 802.11 networks
mdk4 - Wireless attack tool for IEEE 802.11 networks
medusa - fast, parallel, modular, login brute-forcer for network services
mfcuk - MiFare Classic Universal toolKit
mfoc - MIFARE Classic offline cracker
ncat - NMAP netcat reimplementation
ndiff - The Network Mapper - result compare utility
nmap - The Network Mapper
paramspider - Mining parameters from the dark corners of Web Archives
plaso - super timeline all the things -- metapackage
radare2 - free and advanced command line hexadecimal editor
reglookup - utility to analysis for Windows NT-based registry
scalpel - fast filesystem-independent file recovery
stegcracker - steganography brute-force tool
steghide - steganography hiding tool
stegseek - Worlds fastest steghide cracker
tcpick - TCP stream sniffer and connection tracker
time-decode - Timestamp and datetime decoder/encoder
wapiti - web application vulnerability scanner
wifite - Python script to automate wireless auditing using aircrack-ng tools
xmount - tool for crossmounting between disk image formats


 -- Joao Eriberto Mota Filho <eriberto@debian.org>  Sun, 04 Jan 2026 13:44:27 -0300
