On-scene triage open source forensic tool chests: are they effective?

Stavros Shiaeles, Anargyros Chryssanthou, Vasilios Katos*

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review


Considering that a triage related task may essentially make-or-break a digital investigation and the fact that a number of triage tools are freely available online but there is currently no mature framework for practically testing and evaluating them, in this paper we put three open source triage tools to the test. In an attempt to identify common issues, strengths and limitations we evaluate them both in terms of efficiency and compliance to published forensic principles. Our results show that due to the increased complexity and wide variety of system configurations, the triage tools should be made more adaptable, either dynamically or manually (depending on the case and context) instead of maintaining a monolithic functionality.

Original languageEnglish
Pages (from-to)99-115
Number of pages17
JournalDigital Investigation
Issue number2
Publication statusPublished - 1 Sept 2013


  • ACPO principles
  • Incident response
  • Kludge
  • Open source
  • TR3Secure
  • Triage
  • TriageIR


Dive into the research topics of 'On-scene triage open source forensic tool chests: are they effective?'. Together they form a unique fingerprint.

Cite this