Some of these operations can be made easier with specialized software. In particular, the <emphasis role="pkg">sleuthkit</emphasis> package provides many tools to analyze a filesystem. Their use is made easier by the <emphasis>Autopsy Forensic Browser</emphasis> graphical interface (in the <emphasis role="pkg">autopsy</emphasis> package). Some Linux distributions have a "live install" image and contain many programs for forensic analysis, such as Kali Linux (see <xref linkend="sect.kali" />), with its <emphasis>forensic mode</emphasis>, BlackArchLinux, and the commercial Grml-Forensic, based on Grml (see <xref linkend="sect.grml" />). <ulink type="block" url="https://blackarch.org" /> <ulink type="block" url="https://grml-forensic.org/" />
يمكن تسهيل بعض هذه العمليات عبر برمجيات متخصصة. تحديداً، توفر الحزمة <emphasis role="pkg">sleuthkit</emphasis> أدوات عديدة لتحليل نظام الملفات. تُسهّل الواجهة الرسومية <emphasis>Autopsy Forensic Browser</emphasis> (من الحزمة <emphasis role="pkg">autopsy</emphasis> ) استخدام هذه الأدوات.