Digital forensic tools are being developed at a brisk pace in response to the ever increasing variety of forensic targets. Most tools are created for speciﬁc tasks–ﬁle system analysis, memory analysis, network analysis, etc.–and make little effort to inter-operate with one another. This makes it difﬁcult and extremely time-consuming for an investigator to build a wider view of the state of the system under investigation. In this work, we present FACE, a framework for automatic evidence discovery and correlation from a variety of forensic targets. Our prototype implementation demonstrates the integrated analysis and correlation of a disk image, memory image, network capture, and conﬁguration log ﬁles. The results of this analysis are presented as a coherent view of the state of a target system, allowing investigators to quickly understand it. We also present an advanced open source memory analysis tool, ramparser, for the automated analysis of Linux systems.