> For the complete documentation index, see [llms.txt](https://darkcybe.gitbook.io/darkcybe/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://darkcybe.gitbook.io/darkcybe/guides/dfir/dfir-tools.md).

# DFIR Tools

What are the commonly used tools that DFIR Analysts use to investigate incidents, and how are the tools used to provide evidence of malicious activities?

{% content-ref url="/pages/YJyAkAqAhi8W7hVt9c5G" %}
[Malware and File Analysis](/darkcybe/guides/dfir/dfir-tools/malware-and-file-analysis.md)
{% endcontent-ref %}