MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Repository Index
54,641 visible repositories in the index
1–19 of 19 · Most stars
Free, open-source check for traces of mercenary spyware (Pegasus, Predator, Graphite, Candiru and more) on computers, Android phones and iPhone backups. Double-click apps for Windows, Mac and Linux, in 27 languages.
Digging Deeper....
- incident-response
- forensics-investigations
- inventory-management
- endpoint-security
Security sensor for realtime threat detection and protection
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.
📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.
The repository host gives no description.
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
Evidence-based DSM ransomware recovery: preservation, RAM key recovery, copy decryption, and GitLab validation.
The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices
No-jailbreak iOS privacy, entitlement, sandbox & telemetry forensic auditor (inspired by Verlintas/NOIR)
Apache Logfile Security Analyzer
Windows Live Artifacts Acquisition Script
The repository host gives no description.
tr4mpass: Multi-path iOS exploitation framework for A5-A17 with checkm8/checkm9 and forensic gatheri
- a12-bypass
- activator
- bypassing
- checkm8
Incident Response Triage - Windows Evidence Collection for Forensic Analysis
Autonomous DFIR agent: point it at disk images, memory dumps or log exports and get back an investigation that shows its work. Volatility 3, Plaso, YARA and any OpenAI-compatible LLM.
Tool used for dumping memory from Android devices
A tool to extract local data storage of an Android application in one click.
- android-extract
- android
- storage
- security-tools