#1Tools for analyzing hard drives, SSDs, and other storage media to recover data and artifacts.
Kitploit recommended
la3ar0v/tuxresponseAutomated Linux incident response script with live triage, memory acquisition (LiME), disk imaging, YARA scanning, and HTML report generation.
theevidencehunter/forensixDigital Forensics Intelligence Framework
adamwhitehat/judge-jury-and-executableA file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…
google/hashrBuilds forensic file hash sets from disk images, packages, and archives across GCP, AWS, and local sources, with deduplication and PostgreSQL/Spanner…
fishermavis/bsod_bitlocker_recoverPython script for carving Bitlocker VMK keys
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
dwmetz/cyberpipeAn easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.
kfallahi/underlaycopyPowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads
aburgh/disk-arbitratorA Mac OS X forensic utility which manages file system mounting in support of forensic procedures.
rowingdude/analyzemftanalyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.
dfir-dd/dfir-toolkitCLI tools for forensic investigation of Windows artifacts
gregwar/fatcatFAT filesystems explore, extract, repair, and forensic tool
securityjoes/forensicminerA really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
alex-cart/leafLinux Evidence Acquisition Framework
ra3edaj/lab-dfir-cve-2023-38831d
ccob/volumiserCLI and interactive console for listing, browsing, and extracting files from VM disk images (VHDX, VMDK, EBS snapshots, raw disks) for red-team…
synacktiv/veeam-velociraptorProof-of-concept Velociraptor artifacts pack to showcase a remote Veeam forensics pipeline.
