Disk Forensics

rowingdude/analyzemft

analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

diogo-fernan/ir-rescue

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

appliedsec/forensicscanner

Forensic Scanner

gnu-mirror-unofficial/ddrescue

Copies data from damaged or failing storage devices, handles read errors, and performs efficient rescue operations to recover as much data as…

ccob/volumiser

CLI and interactive console for listing, browsing, and extracting files from VM disk images (VHDX, VMDK, EBS snapshots, raw disks) for red-team…

jschicht/extractusnjrnl

Tool to extract the $UsnJrnl from an NTFS volume

nmht3t/rawhive

Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file data…

fboldewin/atmmalscan

Command-line DFIR tool for scanning Windows ATM systems to detect malware traces in process memory and disk, with automated memory dump creation for…

eua/wxhexeditor

wxHexEditor official GIT repo

kfallahi/underlaycopy

PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads

synacktiv/veeam-velociraptor

Proof-of-concept Velociraptor artifacts pack to showcase a remote Veeam forensics pipeline.

ra3edaj/lab-dfir-cve-2023-38831

d

securityjoes/forensicminer

A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.

teamdfir/sift

SIFT

trustedsec/tscopy

Python tool that parses the NTFS $MFT to copy locked files during incident response, bypassing OS locks by reading raw disk locations. Supports…

cherojeong/extundelete

Undelete and recover accidentally erased files from ext3 and ext4 filesystems, using inode scanning and block recovery for forensic and data-loss…

jschicht/logfileparser

Parser for $LogFile on NTFS