Repository Index

Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox

• google-chrome
• hindsight
• chrome
• forensics

UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.

• incident-response
• forensics
• computer-forensics
• triage

PowerForensics provides an all in one platform for live disk forensic analysis

ThePhish: an automated phishing email analysis tool

• email
• detection
• malware
• phishing

Process-aware, eBPF-based tcpdump

• ebpf
• ebpf-tc
• tcpdump
• tcpdump-like

Digital Forensics artifact repository

Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

• digital-security
• forensics
• incident-response
• ioc

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

• dfir
• dissect
• python

AVML - Acquire Volatile Memory for Linux

• rust
• memory-forensics
• linux-security

macOS (& ios) Artifact Parsing Tool

• dfir
• forensics
• macos

Tools and packages that are used for countering forensic activities, including encryption, steganography, and anything that modify attributes. This all includes tools to work with anything in general that makes changes to a system for the purposes of hiding information.

• awesome-list
• awesome
• anti-forensic
• anti-forensics

Digital Forensics Investigation Platform

• dfir
• security
• incident-response
• artifacts

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

• sigma
• python3
• evtx
• sigma-rules

Dynamic unpacker based on PE-sieve

• libpeconv
• pe-sieve
• memory-forensics
• malware-unpacker

Collection of Event ID ressources useful for Digital Forensics and Incident Response

• ir
• dfir
• digitalforensics
• forensics

WinDBG Anti-RootKit Extension

• kernel-mode
• c-plus-plus
• malware
• malware-analysis

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

• security
• dfir
• forensics

Simplifying encrypted traffic analysis for researchers by making protocol decryption effortless.

• frida
• ssl
• security
• hooking

DFIRTrack - The Incident Response Tracking Application

• incident-response
• digital-forensics
• dfir
• incident-response-tooling

Volatility plugin for extracts configuration data of known malware

• malware
• volatility
• forensics
• python

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

• cybersecurity
• incident-response
• sysinternals
• nirsoft

Remote forensics meta tool

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

• threat
• hunt
• red
• blue

A Linux packet crafting tool.

• packet-crafting
• networking
• hacking-tool
• intrusion-prevention