#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
rhematt/snap-scraperExtracts and downloads Snap Map media by coordinates for OSINT, forensic analysis, and research. Supports metadata logging and bulk download.
kevoreilly/capev2Malware Configuration And Payload Extraction
slaughterjames/excelpeekStatic analysis tool for investigating potentially malicious Microsoft Excel files, extracting metadata, macros, and embedded objects to aid digital…
rjbhide/wireshark-forensics-pluginWireshark plugin that correlates network traffic with threat intelligence, asset tags, and vulnerability data to accelerate forensic analysis of PCAP…
andyjsmith/registry-spyCross-platform registry browser for raw Windows registry files
arinerron/heaptracehelps visualize heap operations for pwn and debugging
emalderson/thephishThePhish: an automated phishing email analysis tool
andreafortuna/autotimelinerAutomagically extract forensic timeline from volatile memory dump
frankwxu/digital-forensics-labFree hands-on digital forensics labs for students and faculty
huskyhacks/pmat-labsLabs for Practical Malware Analysis & Triage
cyberdefenders/detectionlabelkDetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.
mgeeky/threadstackspooferThread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners…
themittenmac/truetreeA command line tool for pstree-like output on macOS with additional pid capturing capabilities
ajmartel/irtriageIncident Response Triage - Windows Evidence Collection for Forensic Analysis
jschicht/extractusnjrnlTool to extract the $UsnJrnl from an NTFS volume
jschicht/rawcopyCommandline low level file extractor for NTFS
trustedsec/tscopyPython tool that parses the NTFS $MFT to copy locked files during incident response, bypassing OS locks by reading raw disk locations. Supports…
velocidex/winpmemThe multi-platform memory acquisition tool.
