Disk Forensics

ccob/volumiser

CLI and interactive console for listing, browsing, and extracting files from VM disk images (VHDX, VMDK, EBS snapshots, raw disks) for red-team…

libyal/libvhdi

Library and tools to access the Virtual Hard Disk (VHD) image format

korczis/foremost

File carving utility that recovers deleted files from disk images and raw drives by matching headers, footers, and internal structures via…

dwmetz/cyberpipe

An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.

jschicht/rawcopy

Commandline low level file extractor for NTFS

gregwar/fatcat

FAT filesystems explore, extract, repair, and forensic tool

libyal/libvshadow

Library and tools to access the Volume Shadow Snapshot (VSS) format

kfallahi/underlaycopy

PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads

jschicht/logfileparser

Parser for $LogFile on NTFS

nmht3t/rawhive

Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file data…

trustedsec/tscopy

Python tool that parses the NTFS $MFT to copy locked files during incident response, bypassing OS locks by reading raw disk locations. Supports…

ghassan-elsman/crow-eye

Open-source Windows forensics engine that acquires, parses, and correlates artifacts (MFT, USN, Registry, etc.) to reconstruct timelines with…

la3ar0v/tuxresponse

Automated Linux incident response script with live triage, memory acquisition (LiME), disk imaging, YARA scanning, and HTML report generation.

dmtrkovalenko/ffs

F*ck file system - cli file search tool that bypasses OS kernel and reads your disc directlry

alex-cart/leaf

Linux Evidence Acquisition Framework

jschicht/extractusnjrnl

Tool to extract the $UsnJrnl from an NTFS volume