#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
alessandroz/lazagneCross-platform credential recovery tool that extracts stored passwords from browsers, email clients, databases, system mechanisms, and network…
x64dbg/x64dbgAn open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
monoxgas/srdiShellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode
gregwar/fatcatFAT filesystems explore, extract, repair, and forensic tool
microsoft/ics-forensics-toolsOpen-source forensics framework for analyzing Industrial PLC metadata and project files. Scans for suspicious artifacts in ICS environments to…
santoku/santoku-linuxLinux Distro for Mobile Security, Malware Analysis, and Forensics
fatmike-gh/mcpdebuggerA MCP Debugger Server for Windows executables (x86 and x64). Exposes debugger functionality as MCP Tools for static / dynamic analysis of the…
microsoft/etl2pcapngUtility that converts an .etl file containing a Windows network packet capture into .pcapng format.
dougburks/so-cratesSO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
darnellwashingtonjr94-art/sandb0x-xtract0rAutomated cross-platform sandbox that detonates suspicious files in isolated VMs/emulators, captures network and memory artifacts, and creates LLM…
netsniff-ng/netsniff-ngA Swiss army knife for your daily Linux network plumbing.
qg5casz/walletoolExtracts cryptocurrency private keys and addresses from wallet.dat files for Bitcoin and Litecoin, enabling wallet recovery and forensic analysis.
1ultimat3/pcapvizVisualize network topologies and collect graph statistics based on pcap files
alex-cart/leafLinux Evidence Acquisition Framework
cisco/joyA package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.
magnetforensics/swishdbgextIncident Response & Digital Forensics Debugging Extension
