MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Repository Index
79,841 visible repositories in the index
1–24 of 29 · Most stars
Investigate malicious Windows logon by visualizing and analyzing Windows event log
- security
- dfir
- javascript
- visualization
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
- sleuthkit
- tct
- ntfs
- forensics
IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
- forensic
- recovery
- digital-forensics
TestDisk & PhotoRec
- photorec
- disk
- testdisk
- datarecovery
Linux应急处置/信息搜集/漏洞检测工具，支持基础配置/网络流量/任务计划/环境变量/用户信息/Services/bash/恶意文件/内核Rootkit/SSH/Webshell/挖矿文件/挖矿进程/供应链/服务器风险等13类70+项检查
- linux
- rkhunter
- shell-script
- check
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.
:snowflake: PcapXray - A Network Forensics Tool - To visualize a Packet Capture offline as a Network Diagram including device identification, highlight important communication and file extraction
📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.
PowerForensics provides an all in one platform for live disk forensic analysis
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.
Scalpel is an open source data carving tool. It is not being actively maintained.
WinDBG Anti-RootKit Extension
- kernel-mode
- c-plus-plus
- malware
- malware-analysis
Remote forensics meta tool
Investigate suspicious activity by visualizing Sysmon's event log
- security
- kibana
- elasticsearch
- sysmon
Evidence-based DSM ransomware recovery: preservation, RAM key recovery, copy decryption, and GitLab validation.
The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices
No-jailbreak iOS privacy, entitlement, sandbox & telemetry forensic auditor (inspired by Verlintas/NOIR)
inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques
- forensics
- hypervisor
- memory-dump
- reverse-engineering
'Packet Capture Forensic Evidence eXtractor' is a tool that finds and extracts files from packet capture files
"Evolving AppCompat/AmCache data analysis beyond grep"
Incident Response Triage - Windows Evidence Collection for Forensic Analysis
Read-only check for traces of the November 2026 NIKKE PC launcher compromise. Windows, Linux (Proton, Steam Deck) and macOS.
- iced
- incident-response
- indicators-of-compromise
- infostealer