Designed in the UKAn adaptable Linux workspace
Need a parser, a recovery tool or a second way to check a result? The Acorn gives you room to use open-source Linux tools alongside its own applications.
Free software, not time-limited trials. No affiliate links or paid-upgrade editions are listed. The projects remain independent of SQFR; some maintainers also provide paid services. Their licences permit professional use, subject to their terms.
Choose the task
These tools have Debian packages or an upstream Linux, Python or container installation route. That is not a claim that all 30 are preinstalled or tested in your Acorn build. Check the version and validate your intended use.
30 tools
Create EWF, AFF or raw forensic disk images through a Linux graphical interface.
Debian / Linux route: Debian package: guymager
Check source and destination identities before acquisition.
Licence: GPL v2 or later; bundled components retain their licences
Acquire a raw image with forensic logging and hashing options.
Debian / Linux route: Debian package: dc3dd
A command-line acquisition tool. A reversed source and destination can destroy data.
Licence: GPL v3 or later; mixed supporting components
Create raw copies with hashing, progress and split-output options.
Debian / Linux route: Debian package: dcfldd
Choose the required hash and retain the acquisition log.
Licence: GPL v2 or later; mixed supporting components
Acquire, inspect, verify and export Expert Witness Format evidence images.
Debian / Linux route: Debian package: ewf-tools
The library and command-line utilities have different licence components; use the published copyright file.
Licence: LGPL v3 or later; see component notices
Present supported evidence images through a virtual image view for other tools.
Debian / Linux route: Debian package: xmount
A virtual view is not a new verified acquisition. Check the output format and any write-cache settings.
Licence: GPL v3 or later
Copy readable areas of a failing disk first and resume from a saved mapfile.
Debian / Linux route: Debian package: gddrescue
The Debian package is gddrescue. This is not the different dd_rescue program.
Licence: GPL v2 or later
Control imaging passes and recovery progress when a drive has read errors.
Debian / Linux route: Upstream Linux build or release .deb for the matching system
Upstream provides Linux build guidance and Debian packages. Direct controller access needs a suitable setup; not every USB bridge exposes it.
Licence: GPL v2
Investigate lost partitions and damaged file-system structures.
Debian / Linux route: Debian package: testdisk
TestDisk also has repair functions that write to media. Examine a copy and do not select repair actions on original evidence.
Licence: GPL v2
Carve recognised file types from an image or device when directory records are missing.
Debian / Linux route: Debian package: testdisk
Included in the testdisk package. Carved files may lack original names, paths or complete content.
Licence: GPL v2
Recover candidate files using configured header and footer patterns.
Debian / Linux route: Debian package: scalpel
A mature legacy carver. Review the selected signatures and validate recovered files.
Licence: GPL v2 or later
Carve file types using signatures and internal file structures.
Debian / Linux route: Debian package: foremost
A mature legacy tool. Carving is not proof of when a file was used or who used it.
Licence: Public-domain and GPL components
Inspect partitions, file systems, deleted entries and file metadata from disk images.
Debian / Linux route: Debian package: sleuthkit
This entry covers the command-line Sleuth Kit, not a promise that the Windows Autopsy distribution installs on Debian.
Licence: CPL / IBM Public License and other component licences
Find candidate email addresses, URLs and other features in data without relying on a mounted file system.
Debian / Linux route: Upstream Linux source build; C++ dependencies required
Features are leads. Retain offsets and inspect the surrounding source before interpreting a match.
Licence: GPL v3 or later for current project code; original US government material has separate status
Extract timestamped events from supported artefacts and prepare timelines.
Debian / Linux route: Upstream Linux container; Docker required
Use the project's Linux container or documented build route on Debian. Dependencies and parser coverage are version-specific.
Licence: Apache 2.0
Read Windows Registry hive keys and values in repeatable Python examinations.
Debian / Linux route: Upstream Python package in an isolated environment
A library for scripts, not a one-click interpretation of all Registry evidence.
Licence: Apache 2.0
Read Windows EVTX event records on Linux for review or further processing.
Debian / Linux route: Debian package: python3-evtx
Use known samples and distinguish the stored event from its rendered description.
Licence: Apache 2.0
Extract and search values from Windows Registry hives.
Debian / Linux route: Debian package: reglookup
A mature command-line reader. This link uses the maintained Debian package record because the historic upstream site has a certificate problem.
Licence: GPL v2 or later; see package notices
Inspect SQLite tables and run queries against working copies of supported databases.
Debian / Linux route: Debian package: sqlitebrowser
Preserve associated WAL and SHM files where relevant. The application can edit databases; protect originals.
Licence: MPL / GPL dual licensing; see source notices
Read Windows Recycle Bin metadata such as original paths and recorded deletion times.
Debian / Linux route: Debian package: rifiuti2
A Recycle Bin timestamp has a specific meaning; it is not every form of deletion.
Licence: BSD 3-Clause; package notices apply
Inspect Windows shortcut files for target paths, volume details and recorded metadata.
Debian / Linux route: Debian package: liblnk-utils
A shortcut is one record to corroborate, not proof that a file was copied.
Licence: LGPL v3 or later
Inspect and export Windows Event Log records using libyal's native utilities.
Debian / Linux route: Debian package: libevtx-utils
A separate implementation from python-evtx, useful when checking parser behaviour.
Licence: LGPL v3 or later
Inspect saved packet captures and follow protocol conversations in a graphical interface.
Debian / Linux route: Debian package: wireshark
Encrypted payloads do not become readable just because they appear in a capture.
Licence: GPL v2 or later; component notices apply
Capture authorised network traffic or filter an existing packet capture.
Debian / Linux route: Debian package: tcpdump
Live capture needs suitable permissions and a defined collection scope.
Licence: BSD-style licences; see file notices
Read metadata from photographs, video, Office files and many other formats.
Debian / Linux route: Debian package: libimage-exiftool-perl
It can also write metadata. Use read operations on evidence and interpret times and location fields in context.
Licence: Artistic License or GPL; see component notices
Inspect binary file structures and extract metadata with Python-based parsers.
Debian / Linux route: Debian package: python3-hachoir
Parser support differs by format; keep the tool version with the output.
Licence: GPL v2
Inspect Office documents for macros, embedded objects and other suspicious content.
Debian / Linux route: Upstream Python package in an isolated environment
Static indicators are not a malware verdict. Do not enable macros to inspect a document.
Licence: BSD 2-Clause with separate third-party notices
Inspect PDF objects, streams and references without opening the file in an interactive reader.
Debian / Linux route: Upstream Python 3 script on Debian
Use a contained analysis environment for suspect files. Do not execute extracted code.
Licence: Author-designated public domain
Screen PDF structure for names associated with actions, scripts and embedded content.
Debian / Linux route: Upstream Python 3 script on Debian
A triage aid, not an antivirus scanner or a complete PDF parser.
Licence: Author-designated public domain
Inspect and export records from supported Outlook PST, OST and PAB containers.
Debian / Linux route: Debian package: pff-tools
Review format support and preserve message metadata when preparing exports.
Licence: LGPL v3 or later
Hash file sets and compare later copies with a recorded manifest.
Debian / Linux route: Debian package: hashdeep
A matching hash checks identical bytes, not the truth of a document or a person's identity.
Licence: Public-domain and GPL components
Source and licence review: 24 September 2026. No software from this list was installed or run as part of the directory review. Package versions and upstream requirements can change.
Linux gives you access to thousands of open-source tools across its wider ecosystem. This directory selects 30 for forensic tasks; it does not claim that thousands of forensic applications are bundled with The Acorn.
For a maintained memory-analysis framework, Volatility 3 is another useful Linux option, but its custom licence is outside this directory's standard free-software selection. Review it separately before adoption.
Discuss a tool or workflow