A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
- cybersecurity
- incident-response
- sysinternals
- nirsoft
Repository Index
47,133 repositories indexed
49–72 of 80 · Most stars
Remote forensics meta tool
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
A Linux packet crafting tool.
- packet-crafting
- networking
- hacking-tool
- intrusion-prevention
Forensics artefact collection tool for systems running Microsoft Windows
- dfir
- incident-response
- collection
A framework for orchestrating forensic collection, processing and data export
The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices
inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
- forensics
- hypervisor
- memory-dump
- reverse-engineering
Web interface for the Volatility Memory Forensics Framework
Memory acquisition for Linux that makes sense.
The repository host gives no description.
'Packet Capture Forensic Evidence eXtractor' is a tool that finds and extracts files from packet capture files
Open Source SIEM (Security Information and Event Management system).
- siem
- risk-management
- risk-assessment
- vulnerability-management
Android Mobile Device Hardening
- forensic
- security
- hardening
- android-security
Merge multiple pcap files together, gracefully.
- pcap
- merge
- tcpdump-capture
- packet-processing
CLI utility and Python module for analyzing log files and other data.
- log-analysis
- log-parser
- cli
- security
Invoke-LiveResponse
- ir
- dfir
- winrm
- liveresponse
Incident Response Triage - Windows Evidence Collection for Forensic Analysis
WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing and configuring Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events.
Command line utility and Python package to ease the (un)mounting of forensic disk images
acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.
Digital Forensics Artifacts Knowledge Base
🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit
Tool used for dumping memory from Android devices