> For the complete documentation index, see [llms.txt](https://notes.qazeer.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.qazeer.io/dfir/tools.md).

# Tools

- [Velociraptor](https://notes.qazeer.io/dfir/tools/velociraptor.md)
- [KAPE](https://notes.qazeer.io/dfir/tools/kape.md)
- [Dissect](https://notes.qazeer.io/dfir/tools/dissect.md)
- [plaso](https://notes.qazeer.io/dfir/tools/plaso.md)
- [Splunk usage](https://notes.qazeer.io/dfir/tools/splunk.md)