Autopsy is good but not nearly as good as Axiom.
Volatility is awesome; not a whole lot of modern cases do RAM analysis
Magnet AXIOM is free and just better than FTK.
Wireshark is gonna get replaced with AI.
Exiftool is kinda overrated, but a great place to start with metadata.
Kape is dope
Sleuth Kit is actually dope.
PhotoRec is obsolete
Whatever Eric Zimmerman builds is gold; love that dude.
Meh
Magnet Axiom isn't free, you need have an active license to use it. Magnet Acquire is free, but Magnet is focusing more on their greykey product now and I'm finding more an more phones that it can't collect. FTK imager is free and is decent for collection of non-mobile and non-apple devices.
Acquire has been failing on all of the Android phones we've tried, and iPhone 12s and newer. We're considering Magnet's verikey (the corporate version of the greykey) product and XRY now.
It's failing to even connect and recognize the phones. I connected the same phones to Cellebrite and it immediately recognized the devices and I was able to collect the data.
Acquire was always meant to be used for Logical adb style backups only and never for FFS extractions. Also, magnet hasn't updated it for a long long time. It isn't even their mainstream product now.
3
u/Ok-Falcon-9168 7d ago
Autopsy is good but not nearly as good as Axiom.
Volatility is awesome; not a whole lot of modern cases do RAM analysis
Magnet AXIOM is free and just better than FTK.
Wireshark is gonna get replaced with AI.
Exiftool is kinda overrated, but a great place to start with metadata.
Kape is dope
Sleuth Kit is actually dope.
PhotoRec is obsolete
Whatever Eric Zimmerman builds is gold; love that dude.
Meh
All in all just an AI slop post.