Chainsaw is a fast forensic triage and threat hunting tool for Windows artefacts.
It helps investigators search and analyse data such as Windows Event Logs, the MFT, Shimcache, SRUM, registry hives, and ESE databases. The tool supports Sigma rules as well as custom Chainsaw detection rules, and it can be run on Linux, macOS, and Windows, which makes it a practical option for incident response teams working across different platforms.
This is free and open source software.
Key Features
- Searches Windows event logs and other forensic artefacts using string matching and regular expressions.
- Hunts for malicious activity with Sigma detection rules and custom Chainsaw detection rules.
- Builds execution timelines by analysing Shimcache artefacts and enriching them with Amcache data.
- Analyses the SRUM database to provide additional forensic insights.
- Dumps raw content from artefacts including the MFT, registry hives, and ESE databases.
- Outputs results in ASCII table, CSV, and JSON formats.
- Runs on Linux, macOS, and Windows.
Website: github.com/WithSecureLabs/chainsaw
Support:
Developer: WithSecureLabs
License: GNU General Public License v3.0
Chainsaw is written in Rust. Learn Rust with our recommended free books and free tutorials.
Related Software
| Digital Forensics Tools | |
|---|---|
| GRR Rapid Response | Remote live forensics for incident response |
| Radare2 | Portable reversing framework |
| The Sleuth Kit | Collection of tools for forensic analysis |
| Autopsy Forensic Browser | Graphical interface to SleuthKit |
| iaito | Official graphical interface for radare2 |
| Volatility | Advanced memory forensics framework |
| guymager | Forensic imaging tool based on Qt |
| dcfldd | Enhanced version of dd for forensics and security |
| rdd | Forensic copy program |
| Jomon | Network forensics and passive sniffer |
| Mozilla InvestiGator | Real-time digital forensics and investigation platform |
Read our verdict in the software roundup.
 Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category.This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form. |