DFIR GUI Tools

The command-line parsers in EZ Tools and Linux forensics produce the data; these tools are where you read it, browse an image like a filesystem, and build the picture you put in the report. Each section below is a click path: what to open, in what order, what each pane is telling you, and the two or three features people miss for years. Autopsy gets the most room because it is the free, cross-platform full suite most modules teach; the Zimmerman GUIs get the second most because they are what you will use daily on Windows cases.

[!info] GUI ≠ point-and-hope Every GUI here is a viewer over the same artefacts the CLI tools parse. Know which artefact a result node came from (Autopsy tells you in the Source File column; Registry Explorer in the key path) so you can cite it, reproduce it on the command line, and explain its caveats. A finding you cannot explain is not a finding.

Autopsy

Open-source (Basis Technology / Sleuth Kit), Windows installer or Linux/macOS via the zip + unix_setup.sh. It ingests raw/E01/VHD/VMDK images, local disks, logical folders, and unallocated-space files, runs ingest modules in the background, and files everything into a results tree. Version 4.2x; Java is bundled on Windows.

Case → data source → ingest

1. New Case → name, base directory (put it on fast local disk, not the evidence drive), single-user. Fill Examiner and Case number — they land in the report.
2. Add Data Source → Disk Image or VM File (E01, dd, VHD, VMDK, split images pick .001/.E01 only) → set Time zone of the source machine (critical: Autopsy displays in its configured zone; set both under Tools → Options → View) → Ignore orphan files in FAT only if you are in a hurry → Next.
   • Other types: Local Disk (needs admin; use a write blocker), Logical Files (a KAPE/UAC triage folder — Autopsy will still run keyword/hash/recent-activity modules over it), Unallocated Space Image File (the blkls output), Autopsy Logical Imager Results.
3. Configure Ingest — tick modules. First pass, keep it lean so results appear fast:

4. Finish. Ingest runs in the background (progress bar bottom right); results appear in the tree as modules finish. You can browse immediately — file system nodes are available the moment the image is parsed.

[!tip] Ingest order that saves an afternoon Run Recent Activity + File Type + Hash Lookup + Extension Mismatch + Interesting Files + Encryption Detection first (30–90 min for a 500 GB image). Read those results while a second ingest (right-click the data source → Run Ingest Modules) does Keyword Search indexing, Embedded File Extractor and, if you must, PhotoRec.

Reading the tree (left pane)

Right pane tabs for any selected file: Hex, Text (strings / indexed text / translation), Application (image/PDF/HTML/SQLite/registry/PList viewer), File Metadata (all TSK times, MD5, MIME, $MFT entry, sectors), OS Account, Data Artifacts, Analysis Results, Context (where it came from: download URL, email attachment, zip parent), Annotations (your comments/tags), Other Occurrences (central repo: seen in another case?).

The moves that matter

Right-click any file      → Tag File → Bookmark / Follow Up / Notable Item (tags are what you report)
                          → Extract File(s)          (with original name; keep timestamps via Tools → Options → General)
                          → View in Directory / View Source File / View in Timeline
                          → Add File to Hash Set     (build your notable set as you go)
                          → Search for files with the same MD5
Right-click a directory   → Extract  (whole tree)
Data Source right-click   → Run Ingest Modules       (second pass) / Add Data Source Hash / Delete
Tools → File Search by Attributes   name / size / MIME / date range / known status / hash — "all files modified 20–22 Sep under Users\"
Tools → Run Ingest Modules / View Ingest Progress / Ingest Inbox (alerts as hits land)
Keyword Search (top right bar)   exact / substring / regex, over the Solr index — ad hoc, after indexing finished
Tools → Options → Keyword Search → Lists   add a case list: attacker tool names, IPs, hostnames, user names, "mimikatz|rubeus|sharphound|rclone|anydesk"
Tools → Options → Interesting Files   import the community rules (github.com/sleuthkit/autopsy/... or your own XML) — flags cloud sync, VPN, TOR, wipers by name
Tools → Options → Hash Sets   import NSRL (known), notable sets (yours / ClamAV / community); Central Repository → import from case
Tools → Timeline   see below
Tools → Image/Video Gallery   thumbnail wall grouped by folder, with EXIF/GPS; tag from there
Tools → Communications   graph + table of accounts (email, phone, IM) and who talked to whom
Tools → Geolocation   every GPS point from EXIF/browser/mobile on a map, KML export
Discovery (toolbar)   images / videos / documents / domains by size, date, "past occurrences" — fast triage of media and web activity
Tools → Generate Report   HTML / Excel / KML / STIX / Portable Case (a mini-case with just the tagged items you can hand to counsel)

Timeline view

Tools → Timeline opens a separate window with two modes. Counts (bar chart per time unit — spot the spike of activity at 03:00) → drag to zoom → switch to Details (event clusters by path, expand to individual events) or List (a table you can sort/filter/export). The Filters pane on the left: hide known files, text filter on path, event types (File System: M/A/C/B; Web; Misc: recent docs, installed programs, USB, exif, log entries…). Right-click an event → View File in Directory. Everything you tag shows as a pin. It draws from TSK timestamps plus the Recent Activity results; if you ran the Plaso ingest module the log events appear too.

Autopsy vs Sleuth Kit CLI

Autopsy is Sleuth Kit with a Java GUI and a results database (autopsy.db, SQLite — open it with sqlite3 when you want a bulk export the GUI does not offer: tsk_files, blackboard_artifacts, blackboard_attributes). Anything Autopsy shows, fls/icat/istat can reproduce for the report appendix.

[!warning] Autopsy limits Single-user cases lock the .aut — one analyst at a time (multi-user needs PostgreSQL + Solr + ActiveMQ). Keyword indexing of a full disk can take a day; scope it. Autopsy parses registry via RegRipper and shellbags/browser history natively, but for serious Windows artefact work (MFT with $FN timestamps, USN, Prefetch run times, Amcache SHA-1, SRUM, ShimCache) export the files and use the EZ Tools. Its browser parsing lags Chrome/Firefox schema changes — cross-check with SQLECmd/hindsight.

FTK Imager

Exterro (formerly AccessData), free. Imaging is in acquisition; this is the viewer side.

• File → Add Evidence Item → Image File (E01/dd/AD1/AFF), Physical Drive, Logical Drive, or Contents of a Folder. Evidence Tree (top-left) → File List (top-right, with dates/size/type) → Hex + Properties/Hex Value Interpreter/Custom Content (bottom).
• Every NTFS metafile is browsable: [root]\$MFT, $LogFile, $Extend\$UsnJrnl:$J, $Secure, $Recycle.Bin, plus [unallocated space] and [orphan]. Right-click → Export Files (keeps original timestamps, writes an export log with hashes) → this is how you hand $MFT and the hives to MFTECmd/Registry Explorer without mounting anything.
• Alternate Data Streams show as child entries of the file (file.exe:Zone.Identifier). Deleted files show with a red X and are exportable if their clusters survive.
• Properties tab: all four timestamps, $MFT record number, allocated/unallocated, start cluster. Hex Value Interpreter: select bytes → see them as DOS date, FILETIME, Unix time, int — decoding a raw timestamp without a calculator.
• File → Obtain Protected Files (on a live system): grabs SAM, SECURITY, SOFTWARE, SYSTEM, NTUSER.DATs, $MFT — locked files nothing else copies.
• File → Image Mounting: mount an image as a drive letter (Physical & Logical, Block Device / Read Only) so KAPE, EZ Tools or AV can run against it; File → Unmount when done.
• File → Export File Hash List, Export Directory Listing (CSV of every file with timestamps: the poor man’s fls).
• Custom Content Image: right-click any files/dirs → Add to Custom Content Image (AD1) → File → Create Custom Content Image — a hashed, forensically-wrapped export of just those items (what a triage collection looked like before KAPE).

Arsenal Image Mounter

Free (the paid tier adds write-temporary and VSS-delete). Mounts E01/raw/VHD/VMDK/AFF4 as a real SCSI disk at the Windows disk layer, so Volume Shadow Copies, BitLocker (if you have the key/password), Storage Spaces and dynamic disks behave — things FTK Imager’s mounter does not do. Mount disk image → pick file → Read only (or Write temporary to let Windows “fix” a dirty NTFS volume in a scratch file without touching the image) → OK. The mounted disk appears in Disk Management; volumes get letters. Then: vssadmin list shadows /for=F: and mklink /d C:\vss1 \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\ to browse a shadow copy, or point KAPE --tsource F: --vss. Also launches a Windows VM from the image (Hyper-V/VirtualBox) — booting the suspect’s OS for a screenshot of their desktop, with the image untouched.

Registry Explorer (Eric Zimmerman)

The registry GUI; RECmd is its CLI twin (own sheet).

• File → Load hive → pick SYSTEM/SOFTWARE/SAM/SECURITY/NTUSER.DAT/UsrClass.dat/Amcache.hve. If .LOG1/.LOG2 sit next to it you are asked to replay transaction logs — say yes; it writes a clean copy (*_clean) and shows what changed. A hive loaded without its logs can be missing the last minutes/hours of writes. Load several hives at once (multi-select).
• Left tree = keys with last-write time. Right grid = values (name, type, data, raw). Bottom: Type Viewer (decoded data: FILETIME, ROT13 UserAssist, binary structures), Slack Viewer, Hex.
• Bookmarks tab (right of the tree): hundreds of pre-defined “keys of interest” grouped by hive — Common (Run keys, services, USBSTOR, MountedDevices, NetworkList, TimeZone, ProfileList, Uninstall…) and User created. Click one → jump. Bookmarked keys show red in the tree, blue = has a plugin.
• Plugins: keys with a decoder get an extra grid tab — UserAssist (decoded names, run counts, focus time), ShellBags (in-place), USBSTOR, MountedDevices, NetworkList, TypedURLs, WordWheelQuery, RecentDocs, OpenSavePidlMRU, SAM (users, RIDs, last login, password set, login count, groups), Services, AppCompatCache, BAM, TaskCache, Amcache, TerminalServerClient, 7-Zip/WinRAR history, WinSCP/Putty sessions … Right-click a plugin grid → Export CSV/XLSX.
• Deleted keys/values: Options → Recover deleted keys/values (default on) puts a Unassociated deleted records node and marks recovered items — this is what you show when the attacker cleaned a Run key.
• Search: Ctrl+F / Tools → Find — key names, value names, value data (string/hex), date range on last-write, regex; results grid, double-click to jump. “All Run-key-like values with .exe under AppData in the last 30 days” is one search.
• Timestamps: right-click a key → Export → Key and subkey last write times for the timeline; the whole hive → File → Export → Hive to CSV is what RECmd --csv does.
• Project: File → Project → Save keeps loaded hives + bookmarks + expanded state.

Timeline Explorer (Eric Zimmerman)

Covered from the CSV side in EZ Tools. The habits that make it fast:

• File → Open several CSVs at once (or drag a folder) → one tab each; File → Session → Save so tomorrow you reopen the whole case with filters and tags.
• Filter row under the header for every column: %rclone% (contains), 2026-09-2% (dates as text), >2026-09-20 03:00, = 4624, Like, In (4624,4625). Click the funnel on a header for the pick-list. Filter editor (bottom-left funnel) for boolean chains across columns; the current filter is shown as text at the bottom — copy it into your notes.
• Ctrl+F: search all columns; Ctrl+T toggles tag on selected rows; Tag column checkboxes; Tools → Show only tagged / Clear tags.
• Group by by dragging a column header into the group band: EventId for evtx, ParentPath for MFT, ExecutableName for Prefetch. Collapse everything, expand the interesting groups.
• Conditional Formatting (right-click header) → Highlight Cell Rules — colour 4624 green, 4625 red, 4672 yellow, 7045 orange, 1102 purple; save as part of the layout.
• Column Chooser (right-click header) to hide the 60 columns you do not need; Best Fit (all columns) after.
• Line/Tag/Wrap: View → Word wrap for Payload; View → Show/hide detail pane.
• Copy: Ctrl+C copies selected rows with headers; File → Export the filtered/tagged view to XLSX/CSV/HTML → the appendix.
• Timeline Explorer opens any CSV/TSV (plaso psort -o l2tcsv, Hayabusa CSV, mactime -d output). Dates are recognised if they parse; set --dt in the EZ tools to ISO if a locale fights you.

ShellBags Explorer (Eric Zimmerman)

File → Load offline hive → pick UsrClass.dat (Win7+ Explorer bags live here), then it offers to load the matching NTUSER.DAT; or File → Load active registry on a live box. Left: the folder tree as the user saw it — This PC, drives, \\server\share, removable, Control Panel, zip files browsed as folders. Click a node → grid of children with First Interacted / Last Interacted, MFT entry/sequence (pivot to MFTECmd output), Absolute path, Shell type (GUID-based, network, file entry, zip content…). Pink = has children; italics = derived. Search box filters the tree. Export → CSV of everything = what SBECmd produces. Read the Value column: bag numbers give the order the user created them.

MFTExplorer and EZViewer

MFTExplorer: File → Load $MFT → tree of the volume on the left, and for the selected record the full parsed $STANDARD_INFORMATION / $FILE_NAME / $DATA attributes (all timestamps side by side, resident data in hex, data runs, ADS, security id). It is slow on big MFTs (minutes) but is how you show a timestomp in a screenshot. EZViewer: drag any file onto it — images, Office, PDF, text, hex — renders without the real application ever touching the evidence; the default double-click target for a forensic workstation.

Event logs: Event Viewer, Event Log Explorer, Hayabusa HTML

• Windows Event Viewer: Action → Open Saved Log on an exported .evtx; Filter Current Log by ID, level, time; XML view of an event for the fields; Create Custom View across channels. Usable, slow, no cross-log timeline — export to EvtxECmd for anything real.
• Event Log Explorer (FSPro, free for personal use): opens dozens of .evtx at once, merges them into one view, filters by ID/user/text with saved filter sets, and follows Description fields to columns. The best pure-GUI evtx reader on Windows.
• Hayabusa (hayabusa.exe csv-timeline -d Logs -o out.csv or html-report): Sigma-rule detection; the HTML report (-H report.html) gives rule hits by severity, a timeline chart, top computers/users — the executive view before you dive into Timeline Explorer on the CSV. Chainsaw (chainsaw hunt Logs/ -s sigma/ --mapping mappings/sigma-event-logs-all.yml -r rules/ --csv --output out/) is the alternative, also with an ASCII table output.
• Linux: journalctl has no GUI worth using; gnome-logs for live boxes, otherwise plaso → Timesketch.

Wireshark

The pcap GUI; the CLI lives in TShark. Habits for DFIR: Statistics → Conversations / Endpoints / Protocol Hierarchy first (who talked to whom, how much), Statistics → HTTP → Requests, File → Export Objects → HTTP/SMB/TFTP/DICOM to pull transferred files, Follow → TCP/TLS stream, Analyze → Decode As for odd ports, colouring rules, and frame.time >= "2026-09-20 03:00:00" as a display filter. Add columns by right-click on a field → Apply as Column (http.host, tls.handshake.extensions_server_name, dns.qry.name). Edit → Preferences → Protocols → TLS → (Pre)-Master-Secret log filename decrypts TLS when you captured SSLKEYLOGFILE from the endpoint.

Team-scale review: Velociraptor and Timesketch

• Velociraptor (Rapid7, free): a web GUI server + agents; the Artifacts are VQL queries for every Windows/Linux/macOS artefact (Windows.KapeFiles.Targets runs KAPE targets remotely, Windows.EventLogs.Hayabusa, Linux.Sys.*, Generic.Forensic.Timeline). Hunts run an artifact across the fleet and return one table; Notebooks let you query results with VQL; Offline Collector builds a standalone triage .exe for boxes without an agent. When you have more than a handful of hosts, this replaces walking around with KAPE.
• Timesketch (Google, free, Docker): upload plaso .plaso files or CSV/JSONL timelines → a web timeline multiple analysts search (data_type:"windows:evtx:record" AND event_identifier:4624), tag, star, comment and build stories on. Sigma rules can be run over it; Timesketch + plaso is the Linux-side answer to Timeline Explorer for a whole team. psort.py -o timesketch or the web upload feeds it.

Which GUI for which job

Related

• EZ Tools & KAPE — the CLI parsers behind Registry/Timeline/ShellBags Explorer
• RECmd — Registry Explorer’s command-line twin
• Acquisition — FTK Imager / Guymager imaging, mounting
• Linux forensics — Sleuth Kit CLI that Autopsy wraps, plaso for Timesketch
• TShark — Wireshark’s CLI