dc3dd -http://dc3dd.sourceforge.net/ – Patched version of GNU dd to include a number of features useful for computer forensics. Many of these features were inspired by dcfldd, but were rewritten for dc3dd.
dcfldd – http://dcfldd.sourceforge.net/ – Enhanced version of GNU dd with features useful for forensics and security. Based on the dd program found in the GNU Coreutils package, dcfldd has additional features.
Autopsy – http://www.sleuthkit.org/autopsy/ – The Autopsy Forensic Browser is a graphical interface to the command line digital investigation tools in The Sleuth Kit.
Foremost – http://foremost.sourceforge.net/- Foremost is a console program to recover files based on their headers, footers, and internal data structures. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive.
Scalpel – http://www.digitalforensicssolutions.com/Scalpel/ – Scalpel is a file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files. Scalpel is filesystem-independent and will carve files from FATx, NTFS, ext2/3, or raw partitions.
Volatility – https://www.volatilesystems.com/VolatileWeb/volatility.gsp – The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
HxD – http://mh-nexus.de/en/hxd/ – HxD is a carefully designed and fast hex editor which, additionally to raw disk editing and modifying of main memory (RAM), handles files of any size (Windows) (Run as administrator to use the disk editor).
Raptor 2.0 – http://forwarddiscovery.com/Raptor – Raptor 2.0 is a modified Live Linux distribution based on Ubuntu, you can register and download an ISO for FREE, to create your own bootable CD or USB. It is also available for sale as a pre-installed USB device.
Note: Raptor USB is not able to boot Intel-based MAC computers, this capability is available when using the Raptor CD.
PALADIN – http://www.sumuri.com/ – PALADIN is a modified Live Linux distribution based on Ubuntu that simplifies the process of creating forensic images in a forensically sound manner, for those not comfortable with using the command-line but still want to utilize the power of Linux.