Repository Index

Decrypt and export passwords, cookies, history and more from 20 browsers on Windows, macOS and Linux. For authorized security research, incident response and DFIR.

• chrome
• macos
• windows
• pentest-tool

Direct Memory Access (DMA) Attack Software

Volatility 3.0 development

• digital-investigation
• forensics
• incident-response
• malware

Digging Deeper....

• incident-response
• forensics-investigations
• inventory-management
• endpoint-security

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

• pe-format
• hooking
• pe-dumper
• pe-analyzer

Investigate malicious Windows logon by visualizing and analyzing Windows event log

• security
• dfir
• javascript
• visualization

LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.

AVML - Acquire Volatile Memory for Linux

• rust
• memory-forensics
• linux-security

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.

WinDBG Anti-RootKit Extension

• kernel-mode
• c-plus-plus
• malware
• malware-analysis

Volatility plugin for extracts configuration data of known malware

• malware
• volatility
• forensics
• python

$MFT directory tree reconstruction & FILE record info

• mft-browser
• mft
• powershell
• winform

inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques

• forensics
• hypervisor
• memory-dump
• reverse-engineering

The Volatility Collaborative GUI

• volatility-gui
• volatility-framework
• volatility
• memory-dump

Script for automating Linux memory capture and analysis

VolatilityBot – An automated memory analyzer for malware samples and memory dumps

Memory acquisition for Linux that makes sense.

Web interface for the Volatility Memory Forensics Framework

Remote Memory Acquisition Tool

EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.

Autonomous DFIR agent: point it at disk images, memory dumps or log exports and get back an investigation that shows its work. Volatility 3, Plaso, YARA and any OpenAI-compatible LLM.

• ai-agent
• dfir
• digital-forensics
• incident-response

Read-only check for traces of the November 2026 NIKKE PC launcher compromise. Windows, Linux (Proton, Steam Deck) and macOS.

• iced
• incident-response
• indicators-of-compromise
• infostealer

Tool used for dumping memory from Android devices

A short and small memory forensics helper.

• python
• volatility
• memory-forensics