It deals with extracting data from storage media by searching active, modified, or deleted files.
| Name | Platform | License | Description |
| Software Tools | |||
| Autopsy | Windows, Linux | Open source | Digital forensics platform with a graphical interface for analyzing disk images and smartphones. |
| EnCase Forensic | Windows | Commercial | Comprehensive forensic software that provides various analysis and recovery features for digital data. |
| Sleuth Kit | Linux, Windows | Open source | Library and collection of command-line digital forensic tools for analyzing disk images and volumes. |
| X-Ways Forensics | Windows | Commercial | Advanced software for computer forensics and data analysis, offering a wide range of powerful features. |
| Forensic Toolkit (FTK) | Windows | Commercial | Digital forensics software with advanced analysis, recovery, and visualization tools for forensic experts. |
| Paladin | Linux | Open source | Live CD based on Ubuntu for digital forensics and incident response, bundled with various forensic tools. |
| Hardware Tools | |||
| Tableau Forensic Bridge | Windows,macOS, Linux | Commercial | Portable write-blocking hardware device for connecting hard drives to forensic workstations safely. |
| WiebeTech Drive eRazer | Windows, macOS | Commercial | Standalone hardware solution for securely erasing hard drives and solid-state drives for forensic purposes. |
| Logicube Forensic Dossier | Windows | Commercial | Compact, high-speed hardware write-blocker and disk duplicator for forensic imaging and analysis tasks. |
| CRU WiebeTech Ditto Forensic | Windows | Commercial | Hardware write-blocker and disk duplicator designed for forensic professionals to image and verify data. |
| DeepSpar Disk Imager | Windows | Commercial | Specialized hardware imager with advanced features for imaging damaged or failing hard drives efficiently. |
| Voom HardCopy 3P | Windows | Commercial | Portable hardware write-blocker with triage capabilities, allowing forensic experts to analyze devices on-site. |