#1File recovery, disk recovery, deleted data restoration, and forensic carving tools.
Kitploit recommended
libyal/libewfC library and command-line toolkit for forensic EWF image handling: acquire, export, verify, recover, and mount evidence files in EnCase and SMART…
weareu/xlsxSheetJS xlsx 0.18.5 fork with CVE-2023-30533 and CVE-2024-22363 fixes
neccie/yellowkey-bitlocker-cve-2026-45585Manage BitLocker recovery keys, unlock encrypted drives, and monitor encryption status with this lightweight Windows utility.
log2timeline/plasoDigital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…
libyal/libvshadowLibrary and tools to access the Volume Shadow Snapshot (VSS) format
cgsecurity/testdiskRecovers lost partitions and repairs boot sectors; carves 480+ file formats from damaged disks and filesystems for data recovery and forensic use.
dcarrero/mboxshellmboxShell. Fast terminal viewer for MBOX files of any size. Open, search and export emails from Gmail Takeout backups (50GB+) without loading them…
hameda2/zydraMulti-threaded password recovery tool for RAR, ZIP, PDF, and Linux shadow files using dictionary and brute-force methods with configurable character…
libyal/libfsntfsLibrary and tools to access the Windows New Technology File System (NTFS)
securityronin/memory-forensicWalk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
libyal/libvhdiLibrary and tools to access the Virtual Hard Disk (VHD) image format
labcif/famaForensic Analysis for Mobile Apps (FAMA) -- module for the Autopsy Forensic Browser
disqualifier/psa-2026-00043-recoveryRecovery notes for proxmox advisory ID: PSA-2026-00043-1 (CVE-2023-54391)
pelock/total-commander-ftp-password-recovery-tool-pythonTotal Commander FTP Password Recovery Tool for Python allows you to decrypt the FTP account password information for all Total Commander versions…
rockwellshah/filekeyOffline, open-source web app for passkey-based file encryption and sharing. AES-256-GCM/HPKE, no cloud, no accounts; encrypt to recipients with…
fox-it/dissectDissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from…
libyal/libqcowLibrary and tools to access the QEMU Copy-On-Write (QCOW) image format
