#1Tools for analyzing hard drives, SSDs, and other storage media to recover data and artifacts.
Kitploit recommended
fox-it/dissectDissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from…
pablolec/recoverpyInteractively find and recover deleted or :point_right: overwritten :point_left: files from your terminal
azr43lkn1ght/dfir-labsHands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…
sleuthkit/scalpelFile carving and indexing tool for digital forensics, recovering files from disk images based on header/footer pattern matching, regular expressions,…
lazza/recuperabitA tool for forensic file system reconstruction.
cristianzsh/forensictoolsCollection of forensic tools
libyal/libewfC library and command-line toolkit for forensic EWF image handling: acquire, export, verify, recover, and mount evidence files in EnCase and SMART…
bert-janp/incident-response-powershellPowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…
diogo-fernan/ir-rescueA Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
thewhiteninja/ntfstoolForensics tool for NTFS (parser, mft, bitlocker, deleted files)
biggiesmallsag/nighthawkresponseIncident Response Forensic Framework
aburgh/disk-arbitratorA Mac OS X forensic utility which manages file system mounting in support of forensic procedures.
sekoialab/fastir_collectorLive Windows forensic acquisition tool that collects system artefacts (registry, memory, disk, files) into CSV/JSON for early compromise detection…
rowingdude/analyzemftanalyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.
libyal/libfsntfsLibrary and tools to access the Windows New Technology File System (NTFS)
r3nzsec/irflow-timelineDFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…
