MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Repository Index
88,073 visible repositories in the index
1–24 of 65 · Most stars
Decrypt and export passwords, cookies, history and more from 20 browsers on Windows, macOS and Linux. For authorized security research, incident response and DFIR.
- chrome
- macos
- windows
- pentest-tool
Free, offline checks for known mercenary spyware on Windows, Mac, Linux, iPhone and Android - plus the doors left open, suspicious links, emails, files and QR codes, your accounts, home network and nearby trackers. Apps with a window, 27 languages. Nothing leaves your computer.
Digging Deeper....
- incident-response
- forensics-investigations
- inventory-management
- endpoint-security
Rapidly Search and Hunt through Windows Forensic Artefacts
- attack
- rust
- security
- threat-hunting
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
- python
- python-library
- olefile
- malware-analysis
Collaborative forensic timeline analysis
Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.
- forensics
- java
Network Analysis Tool
Investigate malicious Windows logon by visualizing and analyzing Windows event log
- security
- dfir
- javascript
- visualization
An open-source digital image forensic toolset
- image-forensics
- image-processing
- gui
- toolkit
IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
- forensic
- recovery
- digital-forensics
本程序旨在为安全应急响应人员对Linux主机排查时提供便利，实现主机侧Checklist的自动全面化检测，根据检测结果自动数据聚合，进行黑客攻击路径溯源。
- security
- security-scanning
- security-tools
- vulnerability-scanning
Open EDR public repository
TestDisk & PhotoRec
- photorec
- disk
- testdisk
- datarecovery
Security sensor for realtime threat detection and protection
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.
Analyzing your wechat message history from android
:snowflake: PcapXray - A Network Forensics Tool - To visualize a Packet Capture offline as a Network Diagram including device identification, highlight important communication and file extraction
A framework for secure and scalable network traffic analysis - https://netcap.io
- network
- security
- monitoring
- detection
Interactively find and recover deleted or :point_right: overwritten :point_left: files from your terminal
- python3
- tui
- data
- recovery
Configuration files for the SOF-ELK VM
Cortex: a Powerful Observable Analysis and Active Response Engine
- response
- dfir
- analysis
- analyzer