Repository Index

Forensics artefact collection tool for systems running Microsoft Windows

• dfir
• incident-response
• collection

inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques

• forensics
• hypervisor
• memory-dump
• reverse-engineering

Web interface for the Volatility Memory Forensics Framework

Memory acquisition for Linux that makes sense.

The repository host gives no description.

Open Source SIEM (Security Information and Event Management system).

• siem
• risk-management
• risk-assessment
• vulnerability-management

Merge multiple pcap files together, gracefully.

• pcap
• merge
• tcpdump-capture
• packet-processing

CLI utility and Python module for analyzing log files and other data.

• log-analysis
• log-parser
• cli
• security

Invoke-LiveResponse

• ir
• dfir
• winrm
• liveresponse

WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing and configuring Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events.

Digital Forensics Artifacts Knowledge Base

🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit

• c
• forensics
• log-analysis
• security

Tool used for dumping memory from Android devices

A short and small memory forensics helper.

• python
• volatility
• memory-forensics

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Forensic tool for acquisition, triage and analysis of remote block devices via iSCSI protocol.

• acquisition
• cybersecurity
• forensics
• iscsi

Digital forensic (DFIR) specialist roadmap.

• chfi
• cyber-defense
• cyber-forensics
• dfir

MCP server that channels JVM forensics into structured leak verdicts — for Claude Code.

Next-gen video platform.

• blackvideo
• extensions
• extensions-pack
• ffmpeg-wrapper

Implementation of the packing detection heuristic from the paper "Packed PE File Detection for Malware Forensics" of Han et al.

• binary-analysis
• entropy
• entrypoint
• executable-packing

Advanced eBPF-driven Digital Forensics and Incident Response (DFIR) framework for live Golang malware analysis, threat hunting, and observability.

• bpf
• ebpf
• forensics
• goroutine