Disk Forensics

simsong/bulk_extractor

This is the development tree. Production downloads are at:

r3nzsec/irflow-timeline

DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…

sepinf-inc/iped

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…

ghassan-elsman/crow-eye

Open-source Windows forensics engine that acquires, parses, and correlates artifacts (MFT, USN, Registry, etc.) to reconstruct timelines with…

xchwarze/magic-extractor

Universal Windows extraction tool that detects unknown files and routes them to the right bundled extractor.

frankwxu/digital-forensics-lab

Free hands-on digital forensics labs for students and faculty

lazza/recuperabit

A tool for forensic file system reconstruction.

pablolec/recoverpy

Interactively find and recover deleted or :point_right: overwritten :point_left: files from your terminal

agent-hellboy/ltm

ltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…

thewhiteninja/ntfstool

Forensics tool for NTFS (parser, mft, bitlocker, deleted files)

dmtrkovalenko/ffs

F*ck file system - cli file search tool that bypasses OS kernel and reads your disc directlry

sleuthkit/autopsy

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law…

ericzimmerman/kapefiles

This repository serves as a place for community created Targets and Modules for use with KAPE.

nmht3t/rawhive

Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file data…

bert-janp/incident-response-powershell

PowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…

google/grr

Remote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…

cristiancmoises/zupt

Backup compression with AES-256 authenticated encryption and post-quantum key encapsulation.