Disk Forensics

virustotal/yara-x

A rewrite of YARA in Rust.

log2timeline/plaso

Digital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…

sleuthkit/sleuthkit

Forensic library and CLI toolkit for analyzing disk and file system images, recovering deleted data, generating timelines, and validating evidence…

ericzimmerman/kapefiles

This repository serves as a place for community created Targets and Modules for use with KAPE.

velocidex/velociraptor

Digging Deeper....

sepinf-inc/iped

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…

google/timesketch

Collaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…

frankwxu/digital-forensics-lab

Free hands-on digital forensics labs for students and faculty

meirwah/awesome-incident-response

Curated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…

radkawar/aws-firmware-dump

Acquires the EBS disks of an AWS AMI you can launch, streaming snapshots via EBS direct APIs to a private S3 bucket with sha256 manifests and…

libyal/libvmdk

Library and tools to access the VMware Virtual Disk (VMDK) format

libyal/libewf

C library and command-line toolkit for forensic EWF image handling: acquire, export, verify, recover, and mount evidence files in EnCase and SMART…

simsong/bulk_extractor

This is the development tree. Production downloads are at:

libyal/libvshadow

Library and tools to access the Volume Shadow Snapshot (VSS) format

libyal/libfsntfs

Library and tools to access the Windows New Technology File System (NTFS)

nmht3t/rawhive

Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file data…