Digital Forensics
After-the-fact analysis: memory forensics, disk/partition recovery, file carving, and metadata extraction or removal.
| Tool | Source | Notes |
|---|---|---|
| volatility3 | official | Memory forensics |
| foremost | official | File carving |
| sleuthkit | official | Disk/filesystem forensics |
| testdisk | official | Partition recovery (bundles PhotoRec) |
| perl-image-exiftool | official | Metadata extraction (exiftool) |
| mat2 | official | Metadata removal — strips EXIF/author/editing-history fields before sharing a file (exiftool’s counterpart: reads vs. strips) |
| steghide | aur | Steganography |
| autopsy | aur | Digital forensics platform (GUI on Sleuth Kit) — currently broken (hard AUR dependency on a Java version no longer available) |
mat2 itself warns it isn’t a completeness guarantee — some metadata can
survive in complex file formats even after stripping. VirusTotal and
any.run round this category out for malware
triage that doesn’t need a local sandbox.