Repository Index

Decrypt and export passwords, cookies, history and more from 20 browsers on Windows, macOS and Linux. For authorized security research, incident response and DFIR.

• chrome
• macos
• windows
• pentest-tool

TranslatedWeChat 4.x database decryption and analysis, supporting real-time updates, export of chat records and Moments, and annual summaries.

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.

• sleuthkit
• tct
• ntfs
• forensics

TestDisk & PhotoRec

• photorec
• disk
• testdisk
• datarecovery

detect stegano-hidden data in PNG & BMP

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.

Scalpel is an open source data carving tool. It is not being actively maintained.

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

Volatility plugin for extracts configuration data of known malware

• malware
• volatility
• forensics
• python

:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

• cybersecurity
• incident-response
• sysinternals
• nirsoft

A framework for orchestrating forensic collection, processing and data export

$MFT directory tree reconstruction & FILE record info

• mft-browser
• mft
• powershell
• winform

"Evolving AppCompat/AmCache data analysis beyond grep"

EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.

Foremost is a console program to recover files based on their headers, footers, and internal data structures. c.f., http://foremost.sourceforge.net/

A tool to extract local data storage of an Android application in one click.

• android-extract
• android
• storage
• security-tools