#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
blacktop/ipswiOS/macOS Research Swiss Army Knife
idescriptor/idescriptorprivacy-first, open-source and free idevice management tool written in Rust and Qt
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
cisagov/malcolmContainerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…
withsecurelabs/chainsawRapidly Search and Hunt through Windows Forensic Artefacts
usarmyresearchlab/dshellDshell is a network forensic analysis framework.
purp1ew0lf/blue-team-notesYou didn't think I'd go and leave the blue team out, right?
log2timeline/plasoDigital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…
microsoft/procdump-for-linuxA Linux version of the ProcDump Sysinternals tool
charles2gan/gda-android-reversing-toolthe fastest and most powerful android decompiler(native tool working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which…
aloshdenny/reverse-synthidreverse engineering Gemini's SynthID detection
b16f00t/whapaGraphical forensic toolkit for parsing, decrypting, and extracting WhatsApp data from Android and iOS devices, including Google Drive and iCloud…
jpcertcc/logontracerInvestigate malicious Windows logon by visualizing and analyzing Windows event log
sleuthkit/autopsyAutopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law…
bee-san/pywhat🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it…
rabbitstack/fibratusSecurity sensor for realtime threat detection and protection
yeti-platform/yetiYour Everyday Threat Intelligence
cgsecurity/testdiskRecovers lost partitions and repairs boot sectors; carves 480+ file formats from damaged disks and filesystems for data recovery and forensic use.
