Chainsaw is a fast forensic triage and threat hunting tool for Windows artefacts.
It helps investigators search and analyse data such as Windows Event Logs, the MFT, Shimcache, SRUM, registry hives, and ESE databases. The tool supports Sigma rules as well as custom Chainsaw detection rules, and it can be run on Linux, macOS, and Windows, which makes it a practical option for incident response teams working across different platforms.
This is free and open source software.
Key Features
- Searches Windows event logs and other forensic artefacts using string matching and regular expressions.
- Hunts for malicious activity with Sigma detection rules and custom Chainsaw detection rules.
- Builds execution timelines by analysing Shimcache artefacts and enriching them with Amcache data.
- Analyses the SRUM database to provide additional forensic insights.
- Dumps raw content from artefacts including the MFT, registry hives, and ESE databases.
- Outputs results in ASCII table, CSV, and JSON formats.
- Runs on Linux, macOS, and Windows.
Website: github.com/WithSecureLabs/chainsaw
Support:
Developer: WithSecureLabs
License: GNU General Public License v3.0
Chainsaw is written in Rust. Learn Rust with our recommended free books and free tutorials.
Related Software
| Digital Forensics Tools | |
|---|---|
| GRR Rapid Response | Remote live forensics for incident response |
| Radare2 | Portable reversing framework |
| The Sleuth Kit | Collection of tools for forensic analysis |
| MemProcFS | View physical memory as files in a virtual file system |
| Autopsy Forensic Browser | Graphical interface to SleuthKit |
| iaito | Official graphical interface for radare2 |
| Chainsaw | Fast forensic triage and threat hunting tool for Windows artefacts |
| Velociraptor | Endpoint visibility and collection tool |
| Timesketch | Collaborative forensic timeline analysis |
| Plaso | Python-based digital forensics framework |
| Volatility | Advanced memory forensics framework |
| UAC | Collect forensic artefacts from Linux and other Unix-like systems |
| IPED | Process, index and analyse large collections of digital evidence |
| guymager | Forensic imaging tool based on Qt |
| Dissect | Access and query evidence across disk images and file systems |
| dcfldd | Enhanced version of dd for forensics and security |
| rdd | Forensic copy program |
| Jomon | Network forensics and passive sniffer |
| Mozilla InvestiGator | Real-time digital forensics and investigation platform |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.