Repository Index

Decrypt and export passwords, cookies, history and more from 20 browsers on Windows, macOS and Linux. For authorized security research, incident response and DFIR.

• chrome
• macos
• windows
• pentest-tool

Volatility 3.0 development

• digital-investigation
• forensics
• incident-response
• malware

Digging Deeper....

• incident-response
• forensics-investigations
• inventory-management
• endpoint-security

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.

• sleuthkit
• tct
• ntfs
• forensics

OS X Auditor is a free Mac OS X computer forensics tool

Collaborative Incident Response platform

• forensic
• incident-response
• csirt-tooling
• python

ThePhish: an automated phishing email analysis tool

• email
• detection
• malware
• phishing

Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

• digital-security
• forensics
• incident-response
• ioc

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

• dfir
• dissect
• python

Digital Forensics Investigation Platform

• dfir
• security
• incident-response
• artifacts

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

• security
• dfir
• forensics

DFIRTrack - The Incident Response Tracking Application

• incident-response
• digital-forensics
• dfir
• incident-response-tooling

Evidence-based DSM ransomware recovery: preservation, RAM key recovery, copy decryption, and GitLab validation.

🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.