#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
alex-cart/leafLinux Evidence Acquisition Framework
bohops/rogueassemblyhunterRogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.
dfir-iris/iris-webCollaborative Incident Response platform
chrism09/knx-bus-dumpA tool to listen on a KNX bus via TPUART and the Calimero Project suite and to dump the data from the packets into a Wireshark-Compatible file hex…
emrekybs/bryobioIt was developed to speed up the processes of SOC Analysts during analysis
ryandfir/hindsightBrowser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
pablolec/recoverpyInteractively find and recover deleted or :point_right: overwritten :point_left: files from your terminal
cyb3rfox/aurora-incident-responseIncident Response Documentation made easy. Developed by Incident Responders for Incident Responders
mnrkbys/ma2tlmacOS forensic timeline generator using the analysis result DBs of mac_apt
hasherezade/hollows_hunterScans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory…
spieglt/whatfilesLog what files are accessed by any Linux process
yamato-security/welaAudits Windows event log settings against best-practice guidelines and Sigma-rule detectability, with automated configuration for DFIR readiness.
circl/factual-rules-generatorGenerates YARA rules from installed software on a running OS to baseline known software and find similar installations across digital forensic…
op7ic/blueteam.labBlue Team detection lab created with Terraform and Ansible in Azure.
abdulrhmanalfaifi/fennecArtifact collection tool for *nix systems
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
halpomeranz/lmgScript for automating Linux memory capture and analysis
securitybrewery/catalystSelf-hosted incident response platform with ticket management, automated reaction playbooks, task tracking, and dashboards for streamlining alert…
