📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.
Repository Index
47,133 repositories indexed
25–48 of 80 · Most stars
Collaborative Incident Response platform
- forensic
- incident-response
- csirt-tooling
- python
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
- google-chrome
- hindsight
- chrome
- forensics
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
- incident-response
- forensics
- computer-forensics
- triage
PowerForensics provides an all in one platform for live disk forensic analysis
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
ThePhish: an automated phishing email analysis tool
Process-aware, eBPF-based tcpdump
- ebpf
- ebpf-tc
- tcpdump
- tcpdump-like
Digital Forensics artifact repository
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
- digital-security
- forensics
- incident-response
- ioc
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
- dfir
- dissect
- python
AVML - Acquire Volatile Memory for Linux
- rust
- memory-forensics
- linux-security
macOS (& ios) Artifact Parsing Tool
Tools and packages that are used for countering forensic activities, including encryption, steganography, and anything that modify attributes. This all includes tools to work with anything in general that makes changes to a system for the purposes of hiding information.
- awesome-list
- awesome
- anti-forensic
- anti-forensics
Digital Forensics Investigation Platform
- dfir
- security
- incident-response
- artifacts
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
Dynamic unpacker based on PE-sieve
- libpeconv
- pe-sieve
- memory-forensics
- malware-unpacker
Collection of Event ID ressources useful for Digital Forensics and Incident Response
WinDBG Anti-RootKit Extension
- kernel-mode
- c-plus-plus
- malware
- malware-analysis
:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.
Incident Response Forensic Framework
Simplifying encrypted traffic analysis for researchers by making protocol decryption effortless.
DFIRTrack - The Incident Response Tracking Application
- incident-response
- digital-forensics
- dfir
- incident-response-tooling
Volatility plugin for extracts configuration data of known malware