Volatility 3.0 development
- digital-investigation
- forensics
- incident-response
- malware
Repository Index
68,261 visible repositories in the index
1–18 of 18 · Most stars
Digging Deeper....
- incident-response
- forensics-investigations
- inventory-management
- endpoint-security
Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.
- forensics
- java
Investigate malicious Windows logon by visualizing and analyzing Windows event log
- security
- dfir
- javascript
- visualization
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
- sleuthkit
- tct
- ntfs
- forensics
IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
- forensic
- recovery
- digital-forensics
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
- incident-response
- forensics
- computer-forensics
- triage
Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.
Digital Forensics Investigation Platform
- dfir
- security
- incident-response
- artifacts
:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
Investigate suspicious activity by visualizing Sysmon's event log
- security
- kibana
- elasticsearch
- sysmon
Python installable command line utiltity for mitigation of host and key compromises.
Incident Response - Fast suspicious file finder
- dfir
- investigation
- incident-response
- threat-hunting
This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole har drive.
tr4mpass: Multi-path iOS exploitation framework for A5-A17 with checkm8/checkm9 and forensic gatheri
- a12-bypass
- activator
- bypassing
- checkm8
Autonomous DFIR agent: point it at disk images, memory dumps or log exports and get back an investigation that shows its work. Volatility 3, Plaso, YARA and any OpenAI-compatible LLM.
acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.