Forensicator

Plans and prices

Every plan, in full

On the record

AI investigation

Forensicator AI offers optional per-finding verdicts and a cross-finding summary with a risk score, timeline, and attack chain on Windows.opendocs.forensicator.io · read 29 Sep 2026

AI providers

AI analysis can use local Ollama or commercial providers including OpenAI, Azure OpenAI, Anthropic, or an OpenAI-compatible endpoint.opendocs.forensicator.io · read 29 Sep 2026

API

Core provides REST API keys for integrations and automation.forensicator.io · read 15 Oct 2026

Audience

Enterprise is presented for security operations centers, incident response and digital forensics teams, and MSSPs.forensicator.io · read 29 Sep 2026

Case management

Core organizes investigations, hosts, findings, notes, bookmarks, and incident-response playbooks into cases.forensicator.io · read 15 Oct 2026

Collection features

Windows collection includes RAM acquisition through WinPmem and live network capture converted to PCAP for Wireshark.forensicator.io · read 29 Sep 2026

Collector platforms

The collector supports Windows PowerShell, Linux Bash, macOS Shell, and SSH-based network-device collection.opendocs.forensicator.io · read 15 Oct 2026

Community visibility

The GitHub repository page displayed 635 stars, 94 forks, and 350 commits when opened.github.com · read 15 Oct 2026

Core analysis engines

Core analyzes memory images with Volatility3, PCAP files, raw logs, and Windows forensic artifacts.forensicator.io · read 15 Oct 2026

Deployment

Core is self-hosted through Docker Compose or a Debian/Ubuntu host and supports offline update packages for air-gapped use.forensicator.io · read 15 Oct 2026

Detection

The toolkit evaluates more than 1,400 community Sigma rules, with coverage and data sources varying by operating system.forensicator.io · read 29 Sep 2026

Directory availability

Capterra's October 15, 2026 digital-forensics directory page listed 45 products but did not show Forensicator among the displayed products.capterra.com · read 15 Oct 2026

Documentation

The documentation site contains getting-started, Windows, Linux, macOS, output, advanced-usage, and changelog sections.opendocs.forensicator.io · read 15 Oct 2026

Encryption

Collected artifacts can be optionally encrypted with AES on Windows, Linux, macOS, and network devices.opendocs.forensicator.io · read 15 Oct 2026

Enterprise

Forensicator Enterprise is self-hosted software for uploading, correlating, and managing collector reports across teams.forensicator.io · read 29 Sep 2026

Enterprise access control

Enterprise provides organization-scoped role-based access, hashed prefix-indexed API keys, configurable retention, and activity logging.forensicator.io · read 15 Oct 2026

Enterprise extensibility

Enterprise exposes REST operations, webhooks, and structured JSON exports for ticketing, chat, SIEM, and SOAR integrations.forensicator.io · read 15 Oct 2026

Enterprise integrations

Enterprise exposes an authenticated REST API, webhooks, and structured JSON export; specific SIEM, ticketing, or SOAR integrations are not listed.forensicator.io · read 29 Sep 2026

Alternatives to Forensicator

DI DFIR-IRISWebWindows+4 L LimaCharlieWebWindows+4 D DFIReWebLinux+2 F ForendiWebWindows+3 BX Belkasoft X ForensicAndroidiPhone & iPad+3 GR GRR Rapid ResponseWebWindows+4 SW SIFT WorkstationWindowsLinux+1 BA Binalyze AIRWebWindows+4

Every alternative, ranked