Repository Index

Memory acquisition for Linux that makes sense.

The repository host gives no description.

'Packet Capture Forensic Evidence eXtractor' is a tool that finds and extracts files from packet capture files

Open Source SIEM (Security Information and Event Management system).

• siem
• risk-management
• risk-assessment
• vulnerability-management

Android Mobile Device Hardening

• forensic
• security
• hardening
• android-security

Merge multiple pcap files together, gracefully.

• pcap
• merge
• tcpdump-capture
• packet-processing

Invoke-LiveResponse

• ir
• dfir
• winrm
• liveresponse

Incident Response Triage - Windows Evidence Collection for Forensic Analysis

Command line utility and Python package to ease the (un)mounting of forensic disk images

acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.

Digital Forensics Artifacts Knowledge Base

🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit

• c
• forensics
• log-analysis
• security

Tool used for dumping memory from Android devices

A short and small memory forensics helper.

• python
• volatility
• memory-forensics

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Forensic tool for acquisition, triage and analysis of remote block devices via iSCSI protocol.

• acquisition
• cybersecurity
• forensics
• iscsi

Implementation of the packing detection heuristic from the paper "Packed PE File Detection for Malware Forensics" of Han et al.

• binary-analysis
• entropy
• entrypoint
• executable-packing

Advanced eBPF-driven Digital Forensics and Incident Response (DFIR) framework for live Golang malware analysis, threat hunting, and observability.

• bpf
• ebpf
• forensics
• goroutine