Digital Forensics Framework


Digital Forensics Framework is computer forensics open-source software. It is used by professionals and non-experts to collect, preserve and reveal digital evidence without compromising systems and data.

User interfaces

Digital Forensics Framework offers a graphical user interface developed in PyQt and a classical tree view. Features such as recursive view, tagging, live search and bookmarking are available. Its command line interface allows the user to remotely perform digital investigation. It comes with common shell functions such as completion, task management, globing and keyboard shortcuts. DFF can run batch scripts at startup to automate repetitive tasks. Advanced users and developers can use DFF directly from a Python interpreter to script their investigation.

Distribution methods

In addition to the source code package and binary installers for GNU/Linux and Windows, Digital Forensics Framework is available in operating system distributions as is typical in free and open-source software, including Debian, Fedora and Ubuntu.
Other Digital Forensics Framework methods available are digital forensics oriented distribution and live cd:
Published books that mention Digital Forensics Framework are:
DFF was used to solve the 2010 Digital Forensic Research Workshop challenge consisting of the reconstructing a physical dump of a NAND flash memory.